From 1ea813d49e25c62b470fc21f5ed0f32c32e59287 Mon Sep 17 00:00:00 2001
From: Louis Ryan <lryan@google.com>
Date: Wed, 16 Jan 2019 09:59:09 -0800
Subject: [PATCH 1/2] Replace public/private scoping with namespace scoped
 exports Add flags to control scopeTo defaults Update doc for locality
 weighted LB

---
 mesh/v1alpha1/config.pb.go                    | 578 ++++++++++++++----
 mesh/v1alpha1/config.proto                    | 150 ++++-
 mesh/v1alpha1/istio.mesh.v1alpha1.pb.html     |  98 +--
 networking/v1alpha3/destination_rule.pb.go    | 238 ++++----
 networking/v1alpha3/destination_rule.proto    |  11 +-
 .../istio.networking.v1alpha3.pb.html         | 117 ++--
 networking/v1alpha3/service_entry.pb.go       | 156 +++--
 networking/v1alpha3/service_entry.proto       |  41 +-
 networking/v1alpha3/sidecar.pb.go             |  95 +--
 networking/v1alpha3/sidecar.proto             |  14 -
 networking/v1alpha3/virtual_service.pb.go     | 296 +++++----
 networking/v1alpha3/virtual_service.proto     |  20 +-
 proto.lock                                    |  61 +-
 python/istio_api/mesh/v1alpha1/config_pb2.py  |  92 ++-
 .../v1alpha3/destination_rule_pb2.py          |  76 ++-
 .../networking/v1alpha3/service_entry_pb2.py  |  36 +-
 .../networking/v1alpha3/sidecar_pb2.py        |  32 +-
 .../v1alpha3/virtual_service_pb2.py           | 144 +++--
 18 files changed, 1390 insertions(+), 865 deletions(-)

diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index f981795b62..70705629ff 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -24,7 +24,7 @@ import proto "github.com/gogo/protobuf/proto"
 import fmt "fmt"
 import math "math"
 import google_protobuf "github.com/gogo/protobuf/types"
-import istio_networking_v1alpha33 "istio.io/api/networking/v1alpha3"
+import istio_networking_v1alpha31 "istio.io/api/networking/v1alpha3"
 
 import io "io"
 
@@ -190,7 +190,7 @@ type MeshConfig struct {
 	// Connection timeout used by Envoy. (MUST BE >=1ms)
 	ConnectTimeout *google_protobuf.Duration `protobuf:"bytes,6,opt,name=connect_timeout,json=connectTimeout" json:"connect_timeout,omitempty"`
 	// If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
-	TcpKeepalive *istio_networking_v1alpha33.ConnectionPoolSettings_TCPSettings_TcpKeepalive `protobuf:"bytes,28,opt,name=tcp_keepalive,json=tcpKeepalive" json:"tcp_keepalive,omitempty"`
+	TcpKeepalive *istio_networking_v1alpha31.ConnectionPoolSettings_TCPSettings_TcpKeepalive `protobuf:"bytes,28,opt,name=tcp_keepalive,json=tcpKeepalive" json:"tcp_keepalive,omitempty"`
 	// Class of ingress resources to be processed by Istio ingress
 	// controller.  This corresponds to the value of
 	// "kubernetes.io/ingress.class" annotation.
@@ -243,8 +243,6 @@ type MeshConfig struct {
 	// rules, and other Istio configuration artifacts. Multiple data sources
 	// can be configured for a single control plane.
 	ConfigSources []*ConfigSource `protobuf:"bytes,22,rep,name=config_sources,json=configSources" json:"config_sources,omitempty"`
-	// Locality based load balancing distribution or failover settings.
-	LocalityLbSetting *LocalityLoadBalancerSetting `protobuf:"bytes,31,opt,name=locality_lb_setting,json=localityLbSetting" json:"locality_lb_setting,omitempty"`
 	// $hide_from_docs
 	// This flag is used by secret discovery service(SDS).
 	// If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount
@@ -264,6 +262,63 @@ type MeshConfig struct {
 	// Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
 	// Fallback to old identity format(without trust domain) if not set.
 	TrustDomain string `protobuf:"bytes,26,opt,name=trust_domain,json=trustDomain,proto3" json:"trust_domain,omitempty"`
+	// $hide_from_docs
+	// The default value for the ServiceEntry.exportTo field and services
+	// imported through container registry integrations, e.g. this applies to
+	// Kubernetes Service resources. The value is a list of namespace names and
+	// reserved namespace aliases. The allowed namespace aliases are:
+	//
+	// * - All Namespaces
+	// . - Current Namespace
+	// ~ - No Namespace
+	//
+	// If not set the system will use "*" as the default value which implies that
+	// services are exported to all namespaces.
+	//
+	// 'All namespaces' is a reasonable default for implementations that don't
+	// need to restrict access or visibility of services across namespace
+	// boundaries. If that requirement is present it is generally good practice to
+	// make the default 'Current namespace' so that services are only visible
+	// within their own namespaces by default. Operators can then expand the
+	// visibility of services to other namespaces as needed. Use of 'No Namespace'
+	// is expected to be rare but can have utility for deployments where
+	// dependency management needs to be precise even within the scope of a single
+	// namespace.
+	//
+	// For further discussion see the reference documentation for ServiceEntry,
+	// Sidecar, and Gateway.
+	DefaultServiceExportTo []string `protobuf:"bytes,31,rep,name=default_service_export_to,json=defaultServiceExportTo" json:"default_service_export_to,omitempty"`
+	// $hide_from_docs
+	// The default value for the VirtualService.exportTo field. Has the same
+	// syntax as 'default_service_export_to'.
+	//
+	// If not set the system will use "*" as the default value which implies that
+	// virtual services are exported to all namespaces
+	DefaultVirtualServiceExportTo []string `protobuf:"bytes,32,rep,name=default_virtual_service_export_to,json=defaultVirtualServiceExportTo" json:"default_virtual_service_export_to,omitempty"`
+	// $hide_from_docs
+	// The default value for the DestinationRule.exportTo field. Has the same
+	// syntax as 'default_service_export_to'.
+	//
+	// If not set the system will use "*" as the default value which implies that
+	// destination rules are exported to all namespaces
+	DefaultDestinationRuleExportTo []string `protobuf:"bytes,33,rep,name=default_destination_rule_export_to,json=defaultDestinationRuleExportTo" json:"default_destination_rule_export_to,omitempty"`
+	// $hide_from_docs
+	// The namespace to treat as the administrative root namespace for
+	// istio configuration. When processing a namespace Istio will treat
+	// declarations in the root namespace as if they belonged to each leaf
+	// namespace.
+	//
+	// The precise semantics of this processing are documented on each resource
+	// type.
+	//
+	// There is no default value for this flag in 1.1 but in later releases it
+	// is expected to default to a new namespace, "istio-config", which is
+	// maintained separately from the "istio-system" namespace where an instance
+	// of the control plane runtime is deployed. This separates the concerns of
+	// configuring the control-plane runtime from configuration of the mesh.
+	RootNamespace string `protobuf:"bytes,34,opt,name=root_namespace,json=rootNamespace,proto3" json:"root_namespace,omitempty"`
+	// Locality based load balancing distribution or failover settings.
+	LocalityLbSetting *LocalityLoadBalancerSetting `protobuf:"bytes,35,opt,name=locality_lb_setting,json=localityLbSetting" json:"locality_lb_setting,omitempty"`
 }
 
 func (m *MeshConfig) Reset()                    { *m = MeshConfig{} }
@@ -327,7 +382,7 @@ func (m *MeshConfig) GetConnectTimeout() *google_protobuf.Duration {
 	return nil
 }
 
-func (m *MeshConfig) GetTcpKeepalive() *istio_networking_v1alpha33.ConnectionPoolSettings_TCPSettings_TcpKeepalive {
+func (m *MeshConfig) GetTcpKeepalive() *istio_networking_v1alpha31.ConnectionPoolSettings_TCPSettings_TcpKeepalive {
 	if m != nil {
 		return m.TcpKeepalive
 	}
@@ -446,13 +501,6 @@ func (m *MeshConfig) GetConfigSources() []*ConfigSource {
 	return nil
 }
 
-func (m *MeshConfig) GetLocalityLbSetting() *LocalityLoadBalancerSetting {
-	if m != nil {
-		return m.LocalityLbSetting
-	}
-	return nil
-}
-
 func (m *MeshConfig) GetEnableSdsTokenMount() bool {
 	if m != nil {
 		return m.EnableSdsTokenMount
@@ -474,6 +522,41 @@ func (m *MeshConfig) GetTrustDomain() string {
 	return ""
 }
 
+func (m *MeshConfig) GetDefaultServiceExportTo() []string {
+	if m != nil {
+		return m.DefaultServiceExportTo
+	}
+	return nil
+}
+
+func (m *MeshConfig) GetDefaultVirtualServiceExportTo() []string {
+	if m != nil {
+		return m.DefaultVirtualServiceExportTo
+	}
+	return nil
+}
+
+func (m *MeshConfig) GetDefaultDestinationRuleExportTo() []string {
+	if m != nil {
+		return m.DefaultDestinationRuleExportTo
+	}
+	return nil
+}
+
+func (m *MeshConfig) GetRootNamespace() string {
+	if m != nil {
+		return m.RootNamespace
+	}
+	return ""
+}
+
+func (m *MeshConfig) GetLocalityLbSetting() *LocalityLoadBalancerSetting {
+	if m != nil {
+		return m.LocalityLbSetting
+	}
+	return nil
+}
+
 type MeshConfig_OutboundTrafficPolicy struct {
 	Mode MeshConfig_OutboundTrafficPolicy_Mode `protobuf:"varint,1,opt,name=mode,proto3,enum=istio.mesh.v1alpha1.MeshConfig_OutboundTrafficPolicy_Mode" json:"mode,omitempty"`
 }
@@ -503,7 +586,7 @@ type ConfigSource struct {
 	// Use the tls_settings to specify the tls mode to use. If the MCP server
 	// uses Istio MTLS and shares the root CA with Pilot, specify the TLS
 	// mode as ISTIO_MUTUAL.
-	TlsSettings *istio_networking_v1alpha33.TLSSettings `protobuf:"bytes,2,opt,name=tls_settings,json=tlsSettings" json:"tls_settings,omitempty"`
+	TlsSettings *istio_networking_v1alpha31.TLSSettings `protobuf:"bytes,2,opt,name=tls_settings,json=tlsSettings" json:"tls_settings,omitempty"`
 }
 
 func (m *ConfigSource) Reset()                    { *m = ConfigSource{} }
@@ -518,44 +601,62 @@ func (m *ConfigSource) GetAddress() string {
 	return ""
 }
 
-func (m *ConfigSource) GetTlsSettings() *istio_networking_v1alpha33.TLSSettings {
+func (m *ConfigSource) GetTlsSettings() *istio_networking_v1alpha31.TLSSettings {
 	if m != nil {
 		return m.TlsSettings
 	}
 	return nil
 }
 
-// The following example sets up locality weight for mesh wide service
-// Assume a service resides in "region1/zone1/*" and "region1/zone2/*",
-// and originating clusters also reside in "region1/zone1/*" and "region1/zone2/*".
-// This example specifies when clusters from "region1/zone1/*" accessing the service, 80% of the traffic
-// is shipped to "region1/zone1/*" ratings service endpoints, and the rest 20% to "region1/zone2/*".
+// Locality-weighted load balancing allows administrators to control the
+// distribution of traffic to endpoints based on the localities of where the
+// traffic originates and where it will terminate. These localities are
+// specified using arbitrary labels that designate a hierarchy of localities in
+// {region}/{zone}/{sub-zone} form. For additional detail refer to
+// https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing/locality_weight
+// The following example shows how to setup locality weights mesh-wide.
+//
+// Given a mesh with workloads and their service deployed to "us-west/zone1/*"
+// and "us-west/zone2/*". This example specifies that when traffic accessing a
+// service originates from workloads in "us-west/zone1/*", 80% of the traffic
+// will be sent to endpoints in "us-west/zone1/*", i.e the same zone, and the
+// remaining 20% will go to endpoints in "us-west/zone2/*". This setup is
+// intended to favor routing traffic to endpoint in the same locality. A similar
+// setting is specified for traffic originating in "us-west/zone2/*".
 //
 // ```yaml
 //   distribute:
-//     - from: region1/zone1/*
+//     - from: us-west/zone1/*
 //       to:
-//         "region1/zone1/*": 80
-//         "region1/zone2/*": 20
-//     - from: region1/zone2/*
+//         "us-west/zone1/*": 80
+//         "us-west/zone2/*": 20
+//     - from: us-west/zone2/*
 //       to:
-//         "region1/zone1/*": 20
-//         "region1/zone2/*": 80
+//         "us-west/zone1/*": 20
+//         "us-west/zone2/*": 80
 // ```
 //
-// The following example sets up locality failover policy for the ratings service
-// Assume a service resides in "region1" "region2" and "region3",
-// This example specifies when clusters from "region1/zone1" accessing the service,
-// if endpoints in "region1" becomes unhealthy, traffic will begin to trickle to "region2".
+// If the goal of the operator is not to distribute load across zones and
+// regions but rather to restrict the regionality of failover to meet other
+// operational requirements an operator can set a 'failover' policy instead of
+// a 'distribute' policy.
+//
+// The following example sets up a locality failover policy for regions.
+// Assume a service resides in zones within us-east, us-west & eu-west
+// this example specifies that when endpoints within us-east become unhealthy
+// traffic should failover to endpoints in any zone or sub-zone within eu-west
+// and similarly us-west should failover to us-east.
 //
 // ```yaml
 //  failover:
-//    - from: region1
-//      to: region2
+//    - from: us-east
+//      to: eu-west
+//    - from: us-west
+//      to: us-east
 // ```
 // Locality load balancing settings.
 type LocalityLoadBalancerSetting struct {
-	// Optional: only distribute or failover can be set.
+	// Optional: only one of distribute or failover can be set.
 	// Explicitly specify loadbalancing weight across different zones and geographical locations.
 	// Refer to [Locality weighted load balancing](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing.html?highlight=load_balancing_weight#locality-weighted-load-balancing)
 	// If empty, the locality weight is set according to the endpoints number within it.
@@ -588,15 +689,19 @@ func (m *LocalityLoadBalancerSetting) GetFailover() []*LocalityLoadBalancerSetti
 	return nil
 }
 
-// Originating -> upstream cluster locality weight set, support wildcard matching '*'
-// '*' matches all localities
-// 'region1/*' matches all zones in region1
+// Describes how traffic originating in the 'from' zone or sub-zone is
+// distributed over a set of 'to' zones. Syntax for specifying a zone is
+// {region}/{zone}/{sub-zone} and terminal wildcards are allowed on any
+// segment of the specification. Examples:
+// * - matches all localities
+// us-west/* - all zones and sub-zones within the us-west region
+// us-west/zone-1/* - all sub-zones within us-west/zone-1
 type LocalityLoadBalancerSetting_Distribute struct {
 	// Originating locality, '/' separated, e.g. 'region/zone/sub_zone'.
 	From string `protobuf:"bytes,1,opt,name=from,proto3" json:"from,omitempty"`
-	// Upstream locality to loadbalancing weight map. The sum of all weights should be == 100.
-	// Should assign load balancing weight for all localities, otherwise the traffic are not routed
-	// following the percentage of weight.
+	// Map of upstream localities to traffic distribution weights. The sum of
+	// all weights should be == 100. Any locality not assigned a weight will
+	// receive no traffic.
 	To map[string]uint32 `protobuf:"bytes,2,rep,name=to" json:"to,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"varint,2,opt,name=value,proto3"`
 }
 
@@ -623,12 +728,18 @@ func (m *LocalityLoadBalancerSetting_Distribute) GetTo() map[string]uint32 {
 	return nil
 }
 
-// Specify the traffic failover policy.
-// As zone and sub_zone failover is supported by default, only region can be specified here.
+// Specify the traffic failover policy across regions. Since zone and sub-zone
+// failover is supported by default this only needs to be specified for
+// regions when the operator needs to constrain traffic failover so that
+// the default behavior of failing over to any endpoint globally does not
+// apply. This is useful when failing over traffic across regions would not
+// improve service health or may need to be restricted for other reasons
+// like regulatory controls.
 type LocalityLoadBalancerSetting_Failover struct {
 	// Originating region.
 	From string `protobuf:"bytes,1,opt,name=from,proto3" json:"from,omitempty"`
-	// Destination region the traffic will fail over to when endpoints in local region becomes unhealthy.
+	// Destination region the traffic will fail over to when endpoints in
+	// the 'from' region becomes unhealthy.
 	To string `protobuf:"bytes,2,opt,name=to,proto3" json:"to,omitempty"`
 }
 
@@ -929,10 +1040,69 @@ func (m *MeshConfig) MarshalTo(dAtA []byte) (int, error) {
 		}
 		i++
 	}
+	if len(m.DefaultServiceExportTo) > 0 {
+		for _, s := range m.DefaultServiceExportTo {
+			dAtA[i] = 0xfa
+			i++
+			dAtA[i] = 0x1
+			i++
+			l = len(s)
+			for l >= 1<<7 {
+				dAtA[i] = uint8(uint64(l)&0x7f | 0x80)
+				l >>= 7
+				i++
+			}
+			dAtA[i] = uint8(l)
+			i++
+			i += copy(dAtA[i:], s)
+		}
+	}
+	if len(m.DefaultVirtualServiceExportTo) > 0 {
+		for _, s := range m.DefaultVirtualServiceExportTo {
+			dAtA[i] = 0x82
+			i++
+			dAtA[i] = 0x2
+			i++
+			l = len(s)
+			for l >= 1<<7 {
+				dAtA[i] = uint8(uint64(l)&0x7f | 0x80)
+				l >>= 7
+				i++
+			}
+			dAtA[i] = uint8(l)
+			i++
+			i += copy(dAtA[i:], s)
+		}
+	}
+	if len(m.DefaultDestinationRuleExportTo) > 0 {
+		for _, s := range m.DefaultDestinationRuleExportTo {
+			dAtA[i] = 0x8a
+			i++
+			dAtA[i] = 0x2
+			i++
+			l = len(s)
+			for l >= 1<<7 {
+				dAtA[i] = uint8(uint64(l)&0x7f | 0x80)
+				l >>= 7
+				i++
+			}
+			dAtA[i] = uint8(l)
+			i++
+			i += copy(dAtA[i:], s)
+		}
+	}
+	if len(m.RootNamespace) > 0 {
+		dAtA[i] = 0x92
+		i++
+		dAtA[i] = 0x2
+		i++
+		i = encodeVarintConfig(dAtA, i, uint64(len(m.RootNamespace)))
+		i += copy(dAtA[i:], m.RootNamespace)
+	}
 	if m.LocalityLbSetting != nil {
-		dAtA[i] = 0xfa
+		dAtA[i] = 0x9a
 		i++
-		dAtA[i] = 0x1
+		dAtA[i] = 0x2
 		i++
 		i = encodeVarintConfig(dAtA, i, uint64(m.LocalityLbSetting.Size()))
 		n7, err := m.LocalityLbSetting.MarshalTo(dAtA[i:])
@@ -1227,6 +1397,28 @@ func (m *MeshConfig) Size() (n int) {
 	if m.SidecarToTelemetrySessionAffinity {
 		n += 3
 	}
+	if len(m.DefaultServiceExportTo) > 0 {
+		for _, s := range m.DefaultServiceExportTo {
+			l = len(s)
+			n += 2 + l + sovConfig(uint64(l))
+		}
+	}
+	if len(m.DefaultVirtualServiceExportTo) > 0 {
+		for _, s := range m.DefaultVirtualServiceExportTo {
+			l = len(s)
+			n += 2 + l + sovConfig(uint64(l))
+		}
+	}
+	if len(m.DefaultDestinationRuleExportTo) > 0 {
+		for _, s := range m.DefaultDestinationRuleExportTo {
+			l = len(s)
+			n += 2 + l + sovConfig(uint64(l))
+		}
+	}
+	l = len(m.RootNamespace)
+	if l > 0 {
+		n += 2 + l + sovConfig(uint64(l))
+	}
 	if m.LocalityLbSetting != nil {
 		l = m.LocalityLbSetting.Size()
 		n += 2 + l + sovConfig(uint64(l))
@@ -2028,7 +2220,7 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.TcpKeepalive == nil {
-				m.TcpKeepalive = &istio_networking_v1alpha33.ConnectionPoolSettings_TCPSettings_TcpKeepalive{}
+				m.TcpKeepalive = &istio_networking_v1alpha31.ConnectionPoolSettings_TCPSettings_TcpKeepalive{}
 			}
 			if err := m.TcpKeepalive.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -2075,6 +2267,122 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error {
 			}
 			m.SidecarToTelemetrySessionAffinity = bool(v != 0)
 		case 31:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultServiceExportTo", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DefaultServiceExportTo = append(m.DefaultServiceExportTo, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 32:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultVirtualServiceExportTo", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DefaultVirtualServiceExportTo = append(m.DefaultVirtualServiceExportTo, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 33:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultDestinationRuleExportTo", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DefaultDestinationRuleExportTo = append(m.DefaultDestinationRuleExportTo, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 34:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RootNamespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RootNamespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 35:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field LocalityLbSetting", wireType)
 			}
@@ -2282,7 +2590,7 @@ func (m *ConfigSource) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.TlsSettings == nil {
-				m.TlsSettings = &istio_networking_v1alpha33.TLSSettings{}
+				m.TlsSettings = &istio_networking_v1alpha31.TLSSettings{}
 			}
 			if err := m.TlsSettings.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -2823,91 +3131,97 @@ var (
 func init() { proto.RegisterFile("mesh/v1alpha1/config.proto", fileDescriptorConfig) }
 
 var fileDescriptorConfig = []byte{
-	// 1367 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x56, 0xef, 0x72, 0xd3, 0x48,
-	0x12, 0x8f, 0x1c, 0x43, 0x4c, 0xfb, 0x4f, 0xe4, 0x09, 0x01, 0x61, 0xee, 0x82, 0xf1, 0x15, 0x90,
-	0x4a, 0x5d, 0x39, 0x47, 0x52, 0x54, 0x01, 0xf7, 0x29, 0x71, 0x1c, 0x48, 0x70, 0xe2, 0x94, 0xac,
-	0x70, 0xc7, 0xdd, 0x87, 0xd9, 0x89, 0x34, 0xb6, 0x67, 0x23, 0x6b, 0x54, 0x9a, 0x51, 0xc0, 0xef,
-	0xb4, 0x5b, 0xb5, 0x8f, 0xb1, 0x1f, 0xf7, 0x11, 0xb6, 0x78, 0x83, 0x7d, 0x83, 0xad, 0x99, 0x91,
-	0x12, 0x03, 0x2e, 0xb2, 0xec, 0x7e, 0xd3, 0xfc, 0xfa, 0xd7, 0xdd, 0xd3, 0xbf, 0xee, 0x19, 0x0d,
-	0x34, 0x26, 0x54, 0x8c, 0x37, 0x2f, 0x9e, 0x92, 0x30, 0x1e, 0x93, 0xa7, 0x9b, 0x3e, 0x8f, 0x86,
-	0x6c, 0xd4, 0x8e, 0x13, 0x2e, 0x39, 0x5a, 0x61, 0x42, 0x32, 0xde, 0x56, 0x8c, 0x76, 0xce, 0x68,
-	0xac, 0x8d, 0x38, 0x1f, 0x85, 0x74, 0x53, 0x53, 0xce, 0xd2, 0xe1, 0x66, 0x90, 0x26, 0x44, 0x32,
-	0x1e, 0x19, 0xa7, 0xc6, 0xbd, 0x4f, 0x03, 0xc6, 0x09, 0xff, 0x30, 0xcd, 0x4c, 0x1b, 0x11, 0x95,
-	0xef, 0x79, 0x72, 0xce, 0xa2, 0x51, 0x4e, 0xd8, 0xde, 0x0c, 0xa8, 0x90, 0x2c, 0xd2, 0x11, 0x70,
-	0x92, 0x86, 0xd4, 0x70, 0x5b, 0xbf, 0xd9, 0x00, 0x47, 0x54, 0x8c, 0x3b, 0x7a, 0x43, 0xe8, 0x9f,
-	0x80, 0x26, 0xec, 0x03, 0x4d, 0xb0, 0x3f, 0xa6, 0xfe, 0x39, 0x16, 0x34, 0xb9, 0xa0, 0x89, 0x63,
-	0x35, 0xad, 0xf5, 0x5b, 0xae, 0xad, 0x2d, 0x1d, 0x65, 0x18, 0x68, 0x1c, 0xb5, 0x61, 0xc5, 0xb0,
-	0x13, 0x1a, 0xf3, 0x44, 0xe6, 0xf4, 0x82, 0xa6, 0xd7, 0xb5, 0xc9, 0xd5, 0x96, 0x8c, 0xbf, 0x05,
-	0xab, 0x01, 0x13, 0xe4, 0x2c, 0xa4, 0x38, 0xe6, 0x21, 0xf3, 0xa7, 0x26, 0x8d, 0x70, 0x16, 0x9b,
-	0xd6, 0x7a, 0xc9, 0x5d, 0xc9, 0x8c, 0x27, 0xda, 0xa6, 0x13, 0x09, 0xb4, 0x01, 0x75, 0x5d, 0x1b,
-	0x0e, 0x99, 0x90, 0x34, 0xc2, 0x2a, 0x9c, 0x53, 0x6c, 0x5a, 0xeb, 0x37, 0xdc, 0x65, 0x6d, 0xe8,
-	0x69, 0xfc, 0x84, 0x27, 0x12, 0x3d, 0x06, 0x03, 0xe1, 0xb1, 0x94, 0xb1, 0x61, 0xde, 0xd0, 0xcc,
-	0xaa, 0x86, 0x5f, 0x4b, 0x19, 0x6b, 0xde, 0x2e, 0x2c, 0xfb, 0x3c, 0x8a, 0xa8, 0x2f, 0xb1, 0x64,
-	0x13, 0xca, 0x53, 0xe9, 0xdc, 0x6c, 0x5a, 0xeb, 0xe5, 0xad, 0x7b, 0x6d, 0xa3, 0x7a, 0x3b, 0x57,
-	0xbd, 0xbd, 0x97, 0xa9, 0xee, 0xd6, 0x32, 0x0f, 0xcf, 0x38, 0xa0, 0x7f, 0x40, 0x95, 0x45, 0xa3,
-	0x84, 0x0a, 0x81, 0xfd, 0x90, 0x08, 0xe1, 0x2c, 0xe9, 0xaa, 0x2b, 0x19, 0xd8, 0x51, 0x18, 0x7a,
-	0x02, 0xcb, 0x39, 0x49, 0x69, 0xc3, 0x7c, 0xea, 0x94, 0x34, 0xad, 0x96, 0xc1, 0x03, 0x83, 0xa2,
-	0x09, 0xdc, 0xbd, 0x8c, 0xc6, 0x23, 0x99, 0xf0, 0x30, 0xa4, 0x09, 0x9e, 0xf0, 0x80, 0x3a, 0xb7,
-	0x9a, 0xd6, 0x7a, 0x6d, 0xeb, 0x59, 0x7b, 0xce, 0x90, 0xb4, 0xaf, 0x3a, 0xd7, 0x3e, 0xc8, 0xf2,
-	0x5e, 0x7a, 0x1f, 0xf1, 0x80, 0xba, 0xab, 0x6c, 0x1e, 0x8c, 0xfa, 0x50, 0x26, 0xa9, 0x1c, 0x67,
-	0x5d, 0x70, 0x40, 0xa7, 0xd8, 0xb8, 0x2e, 0xc5, 0x4e, 0x2a, 0xc7, 0xa6, 0x37, 0xbb, 0x05, 0xc7,
-	0x72, 0x81, 0x5c, 0xae, 0xd1, 0x01, 0xd4, 0x93, 0x40, 0xe0, 0x84, 0x0e, 0x13, 0x2a, 0xc6, 0x38,
-	0xa0, 0x21, 0x99, 0x3a, 0xe5, 0x6b, 0x34, 0xd5, 0x51, 0x96, 0x93, 0x40, 0xb8, 0xc6, 0x6d, 0x4f,
-	0x79, 0xa1, 0x47, 0x50, 0xa3, 0x91, 0x9e, 0x11, 0x99, 0x10, 0x9f, 0x45, 0x23, 0xa7, 0xa2, 0xa7,
-	0xa3, 0x6a, 0x50, 0xcf, 0x80, 0xaa, 0xd7, 0xc4, 0xf7, 0x95, 0x60, 0x21, 0x1f, 0xe1, 0x21, 0x0b,
-	0xa9, 0x53, 0xd5, 0xd2, 0x56, 0x0d, 0xdc, 0xe3, 0xa3, 0x7d, 0x16, 0x52, 0xf4, 0x0a, 0x6a, 0x01,
-	0x1d, 0x92, 0x34, 0x94, 0xd8, 0x1c, 0x3a, 0xa7, 0xa6, 0xb7, 0xd5, 0x9c, 0x5b, 0xed, 0x89, 0x9a,
-	0x13, 0x53, 0xae, 0x5b, 0xcd, 0xfc, 0xb2, 0xa3, 0xf1, 0x04, 0xaa, 0x66, 0xd8, 0x49, 0x10, 0x28,
-	0x49, 0x1d, 0x5b, 0xa5, 0xd3, 0x35, 0x54, 0xb4, 0x61, 0xc7, 0xe0, 0xaa, 0x97, 0x3c, 0x95, 0x67,
-	0x3c, 0x8d, 0x02, 0x55, 0xc2, 0x70, 0xc8, 0xfc, 0x5c, 0xe8, 0xba, 0x4e, 0x7d, 0x6d, 0x2f, 0xfb,
-	0x99, 0xbb, 0x67, 0xbc, 0x8d, 0xc6, 0xee, 0x2a, 0x9f, 0x07, 0xa3, 0x3d, 0x78, 0x90, 0xe9, 0xe5,
-	0x87, 0x8c, 0x46, 0x12, 0x0b, 0x16, 0x7c, 0x7a, 0xbe, 0x9c, 0x15, 0x2d, 0xe0, 0x7d, 0x43, 0xeb,
-	0x68, 0xd6, 0x80, 0x05, 0xb3, 0xe7, 0x0c, 0x35, 0xa1, 0x22, 0x02, 0x81, 0xd3, 0x40, 0xe0, 0x98,
-	0xc8, 0xb1, 0x73, 0x5b, 0x6b, 0x09, 0x22, 0x10, 0xa7, 0x81, 0x38, 0x21, 0x72, 0xac, 0x5a, 0x2c,
-	0xbe, 0x68, 0xf1, 0xea, 0x1f, 0x6a, 0xb1, 0xf8, 0xac, 0xc5, 0xaf, 0xa1, 0x66, 0x7a, 0x81, 0x05,
-	0x4f, 0x13, 0x9f, 0x0a, 0xe7, 0x4e, 0x73, 0x71, 0xbd, 0xbc, 0xf5, 0x70, 0xae, 0x30, 0x46, 0x94,
-	0x81, 0x66, 0xba, 0x55, 0x7f, 0x66, 0x25, 0xd0, 0x36, 0xdc, 0xc9, 0x8a, 0x57, 0x7b, 0x93, 0xfc,
-	0x9c, 0x46, 0x78, 0xc2, 0xd3, 0x48, 0x3a, 0x77, 0xcd, 0x95, 0x62, 0xac, 0x83, 0x40, 0x78, 0xca,
-	0x76, 0xa4, 0x4c, 0xea, 0x4a, 0x99, 0x1d, 0x1d, 0x9e, 0x4c, 0x88, 0x74, 0x1c, 0x5d, 0xf0, 0xf2,
-	0xd5, 0xf0, 0x68, 0x58, 0x25, 0x98, 0x95, 0x12, 0x0f, 0x09, 0x0b, 0x31, 0x8f, 0x69, 0xe4, 0xdc,
-	0x33, 0x09, 0xe2, 0x2b, 0x11, 0xf7, 0x09, 0x0b, 0xfb, 0x31, 0x8d, 0xd0, 0x43, 0xa8, 0xc8, 0x24,
-	0x15, 0x12, 0x07, 0x7c, 0x42, 0x58, 0xe4, 0x34, 0x74, 0xec, 0xb2, 0xc6, 0xf6, 0x34, 0x84, 0x08,
-	0xac, 0xcc, 0xec, 0x81, 0x46, 0x3e, 0x0f, 0xd4, 0xa8, 0xdf, 0xd7, 0x27, 0xf1, 0xe9, 0xb5, 0x27,
-	0x31, 0xdf, 0x65, 0x37, 0x73, 0x74, 0xeb, 0xe4, 0x73, 0x08, 0x71, 0xa8, 0x4a, 0x3f, 0xc6, 0xe7,
-	0x94, 0xc6, 0x24, 0x64, 0x17, 0xd4, 0xf9, 0x9b, 0x6e, 0xd6, 0x61, 0x16, 0xfc, 0xea, 0x27, 0x91,
-	0xa7, 0xd8, 0x56, 0x52, 0xab, 0x3b, 0x8e, 0xf1, 0xe8, 0x84, 0xf3, 0x70, 0x40, 0xa5, 0x64, 0xd1,
-	0x48, 0xb4, 0xbd, 0xce, 0xc9, 0xd5, 0xb7, 0x1f, 0xbf, 0xc9, 0x23, 0xba, 0x15, 0x39, 0xb3, 0x42,
-	0x1b, 0x80, 0xf4, 0x0c, 0x09, 0x8a, 0xcf, 0x9f, 0x0b, 0x2c, 0x08, 0xfe, 0xfe, 0xbd, 0x74, 0xfe,
-	0xae, 0x75, 0xaa, 0xa9, 0x49, 0x12, 0xf4, 0xcd, 0x73, 0x31, 0x20, 0x87, 0xef, 0x25, 0x3a, 0x81,
-	0x47, 0x6a, 0x4e, 0x7d, 0x92, 0x60, 0xc9, 0xb1, 0xa4, 0x21, 0x9d, 0x50, 0x99, 0x4c, 0xb1, 0xa0,
-	0x42, 0xa8, 0x5f, 0x94, 0x9a, 0xf0, 0x88, 0xc9, 0xa9, 0xb3, 0xa6, 0xdd, 0x1f, 0x66, 0x64, 0x8f,
-	0x7b, 0x39, 0x75, 0x60, 0x98, 0x3b, 0x19, 0x11, 0x7d, 0x07, 0x2b, 0x21, 0xf7, 0x49, 0xc8, 0xe4,
-	0x14, 0x87, 0x67, 0x58, 0x98, 0x0d, 0x3b, 0x0f, 0x74, 0xd1, 0xff, 0x9a, 0xab, 0x68, 0x2f, 0xe3,
-	0xf7, 0x38, 0x09, 0x76, 0x49, 0x48, 0x22, 0x9f, 0x26, 0x59, 0xa1, 0x6e, 0x3d, 0x0f, 0xd6, 0x3b,
-	0xcb, 0xa0, 0xc6, 0x8f, 0x16, 0xac, 0xce, 0x3d, 0x9a, 0xe8, 0x18, 0x8a, 0xfa, 0xae, 0xb6, 0x74,
-	0xfb, 0x5e, 0xfe, 0xa9, 0xf3, 0xdd, 0xd6, 0x17, 0xb6, 0x8e, 0xd3, 0xda, 0x83, 0xa2, 0xbe, 0xa7,
-	0xeb, 0x50, 0x75, 0xbb, 0xaf, 0x0e, 0x06, 0x9e, 0xfb, 0x0e, 0xf7, 0x8f, 0x7b, 0xef, 0xec, 0x05,
-	0x54, 0x85, 0x5b, 0x3b, 0xbd, 0x5e, 0xff, 0x3f, 0x78, 0xe7, 0xf8, 0x9d, 0x6d, 0xb5, 0x8a, 0xa5,
-	0x82, 0x5d, 0xd8, 0xb8, 0xfd, 0xf6, 0xc0, 0xf5, 0x4e, 0x77, 0x7a, 0x78, 0xd0, 0x75, 0xdf, 0x1e,
-	0x74, 0xba, 0x9a, 0xdc, 0x7a, 0x01, 0xab, 0x73, 0xff, 0x0a, 0x68, 0x09, 0x16, 0xfb, 0xfb, 0xfb,
-	0xf6, 0x02, 0x2a, 0xc3, 0xd2, 0x5e, 0x77, 0x7f, 0xe7, 0xb4, 0xe7, 0xd9, 0x16, 0x02, 0xb8, 0x39,
-	0xf0, 0xdc, 0x83, 0x8e, 0x67, 0x17, 0x5a, 0x8f, 0x01, 0xae, 0x6e, 0x7b, 0x54, 0x82, 0xe2, 0x71,
-	0xff, 0xb8, 0x6b, 0x2f, 0xa0, 0x1a, 0xc0, 0xd1, 0xa9, 0xce, 0xe4, 0xf5, 0x06, 0xb6, 0xd5, 0x7a,
-	0x02, 0xf5, 0x2f, 0x66, 0x51, 0xd1, 0xbd, 0xee, 0x7f, 0x3d, 0x7b, 0x41, 0x7d, 0x1d, 0x0e, 0xfa,
-	0xc7, 0xb6, 0x75, 0x58, 0x2c, 0x2d, 0xdb, 0xf6, 0x61, 0xb1, 0x84, 0xec, 0x95, 0x96, 0x80, 0xca,
-	0xec, 0x99, 0x46, 0x0e, 0x2c, 0xe5, 0x77, 0xaa, 0x79, 0x69, 0xe4, 0x4b, 0x74, 0x00, 0x15, 0x19,
-	0x8a, 0xbc, 0x97, 0x42, 0xbf, 0x2c, 0xca, 0x5b, 0x8f, 0xbf, 0x32, 0xc1, 0x5e, 0x6f, 0x90, 0x8f,
-	0xaa, 0x5b, 0x96, 0xa1, 0xc8, 0x17, 0xad, 0x9f, 0x16, 0xe1, 0xfe, 0x57, 0xfa, 0x8d, 0xfe, 0x0f,
-	0x10, 0x30, 0x21, 0x13, 0x76, 0x96, 0x4a, 0xd5, 0x48, 0x75, 0x1f, 0xfd, 0xfb, 0x5b, 0xa7, 0xa6,
-	0xbd, 0x77, 0x19, 0xc2, 0x9d, 0x09, 0x87, 0x4e, 0xa1, 0xa4, 0x2e, 0x0e, 0x6e, 0x5e, 0x47, 0x2a,
-	0xf4, 0x8b, 0x6f, 0x0e, 0xbd, 0x9f, 0x05, 0x70, 0x2f, 0x43, 0x35, 0x7e, 0xb0, 0x00, 0xae, 0x32,
-	0x22, 0x04, 0xc5, 0x61, 0xc2, 0x27, 0x99, 0x88, 0xfa, 0x1b, 0x0d, 0xa0, 0x20, 0x79, 0x96, 0xb3,
-	0xf3, 0x17, 0xca, 0x69, 0x7b, 0xbc, 0x1b, 0xc9, 0x64, 0xea, 0x16, 0x24, 0x6f, 0x3c, 0x83, 0xa5,
-	0x6c, 0x89, 0x6c, 0x58, 0x3c, 0xa7, 0xd3, 0x2c, 0xa5, 0xfa, 0x44, 0xb7, 0xe1, 0xc6, 0x05, 0x09,
-	0x53, 0xaa, 0x9b, 0x55, 0x75, 0xcd, 0xe2, 0x65, 0xe1, 0xb9, 0xd5, 0x68, 0x43, 0x29, 0x2f, 0x62,
-	0xee, 0x5e, 0x6b, 0xd9, 0x5e, 0x15, 0x52, 0x90, 0x7c, 0x77, 0xfd, 0xe7, 0x8f, 0x6b, 0xd6, 0x2f,
-	0x1f, 0xd7, 0xac, 0x5f, 0x3f, 0xae, 0x59, 0xff, 0x6b, 0x98, 0xcd, 0x33, 0xbe, 0x49, 0x62, 0xb6,
-	0xf9, 0xc9, 0xeb, 0xf7, 0xec, 0xa6, 0xfe, 0xf1, 0x6c, 0xff, 0x1e, 0x00, 0x00, 0xff, 0xff, 0x31,
-	0xb4, 0x42, 0x7f, 0x66, 0x0b, 0x00, 0x00,
+	// 1463 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x56, 0xdd, 0x72, 0xdb, 0xb8,
+	0x15, 0x0e, 0x65, 0x27, 0x76, 0x8e, 0x7e, 0x4c, 0xc1, 0x71, 0x96, 0x51, 0xba, 0x5e, 0x59, 0x3b,
+	0x49, 0x34, 0x9e, 0x8e, 0xdc, 0x38, 0xb3, 0x33, 0xc9, 0xf6, 0xca, 0x91, 0xe4, 0x8d, 0xbd, 0x8a,
+	0xe5, 0xa1, 0xe8, 0xb4, 0x69, 0x2f, 0x50, 0x98, 0x84, 0x24, 0xd4, 0x14, 0xc1, 0x21, 0x40, 0x27,
+	0x7a, 0xa7, 0x76, 0xa6, 0x8f, 0xd1, 0xcb, 0x3e, 0x42, 0x27, 0x77, 0x7d, 0x8b, 0x0e, 0x7e, 0x68,
+	0x29, 0x59, 0xcd, 0xba, 0xdb, 0xbd, 0x23, 0xbe, 0xf3, 0x9d, 0xef, 0x00, 0xe7, 0x1c, 0xe0, 0x10,
+	0x1a, 0x33, 0x2a, 0xa6, 0x07, 0xd7, 0xcf, 0x49, 0x9c, 0x4e, 0xc9, 0xf3, 0x83, 0x90, 0x27, 0x63,
+	0x36, 0xe9, 0xa4, 0x19, 0x97, 0x1c, 0x6d, 0x33, 0x21, 0x19, 0xef, 0x28, 0x46, 0xa7, 0x60, 0x34,
+	0x76, 0x27, 0x9c, 0x4f, 0x62, 0x7a, 0xa0, 0x29, 0x97, 0xf9, 0xf8, 0x20, 0xca, 0x33, 0x22, 0x19,
+	0x4f, 0x8c, 0x53, 0xe3, 0xd1, 0xe7, 0x82, 0x69, 0xc6, 0x3f, 0xce, 0xad, 0x69, 0x3f, 0xa1, 0xf2,
+	0x03, 0xcf, 0xae, 0x58, 0x32, 0x29, 0x08, 0x2f, 0x0e, 0x22, 0x2a, 0x24, 0x4b, 0xb4, 0x02, 0xce,
+	0xf2, 0x98, 0x1a, 0x6e, 0xeb, 0x3f, 0x08, 0xe0, 0x2d, 0x15, 0xd3, 0xae, 0xde, 0x10, 0xfa, 0x2d,
+	0xa0, 0x19, 0xfb, 0x48, 0x33, 0x1c, 0x4e, 0x69, 0x78, 0x85, 0x05, 0xcd, 0xae, 0x69, 0xe6, 0x39,
+	0x4d, 0xa7, 0x7d, 0xdf, 0x77, 0xb5, 0xa5, 0xab, 0x0c, 0x23, 0x8d, 0xa3, 0x0e, 0x6c, 0x1b, 0x76,
+	0x46, 0x53, 0x9e, 0xc9, 0x82, 0x5e, 0xd2, 0xf4, 0xba, 0x36, 0xf9, 0xda, 0x62, 0xf9, 0x87, 0xb0,
+	0x13, 0x31, 0x41, 0x2e, 0x63, 0x8a, 0x53, 0x1e, 0xb3, 0x70, 0x6e, 0xc2, 0x08, 0x6f, 0xad, 0xe9,
+	0xb4, 0x37, 0xfd, 0x6d, 0x6b, 0x3c, 0xd7, 0x36, 0x1d, 0x48, 0xa0, 0x7d, 0xa8, 0xeb, 0xb3, 0xe1,
+	0x98, 0x09, 0x49, 0x13, 0xac, 0xe4, 0xbc, 0xf5, 0xa6, 0xd3, 0xbe, 0xeb, 0x6f, 0x69, 0xc3, 0x40,
+	0xe3, 0xe7, 0x3c, 0x93, 0xe8, 0x29, 0x18, 0x08, 0x4f, 0xa5, 0x4c, 0x0d, 0xf3, 0xae, 0x66, 0x56,
+	0x35, 0xfc, 0x46, 0xca, 0x54, 0xf3, 0x5e, 0xc3, 0x56, 0xc8, 0x93, 0x84, 0x86, 0x12, 0x4b, 0x36,
+	0xa3, 0x3c, 0x97, 0xde, 0xbd, 0xa6, 0xd3, 0x2e, 0x1f, 0x3e, 0xea, 0x98, 0xac, 0x77, 0x8a, 0xac,
+	0x77, 0x7a, 0x36, 0xeb, 0x7e, 0xcd, 0x7a, 0x04, 0xc6, 0x01, 0x7d, 0x0b, 0x55, 0x96, 0x4c, 0x32,
+	0x2a, 0x04, 0x0e, 0x63, 0x22, 0x84, 0xb7, 0xa1, 0x4f, 0x5d, 0xb1, 0x60, 0x57, 0x61, 0xe8, 0x19,
+	0x6c, 0x15, 0x24, 0x95, 0x1b, 0x16, 0x52, 0x6f, 0x53, 0xd3, 0x6a, 0x16, 0x1e, 0x19, 0x14, 0xcd,
+	0xe0, 0xab, 0x1b, 0x35, 0x9e, 0xc8, 0x8c, 0xc7, 0x31, 0xcd, 0xf0, 0x8c, 0x47, 0xd4, 0xbb, 0xdf,
+	0x74, 0xda, 0xb5, 0xc3, 0xef, 0x3a, 0x2b, 0x9a, 0xa4, 0xb3, 0xa8, 0x5c, 0xe7, 0xc4, 0xc6, 0xbd,
+	0xf1, 0x7e, 0xcb, 0x23, 0xea, 0xef, 0xb0, 0x55, 0x30, 0x1a, 0x42, 0x99, 0xe4, 0x72, 0x6a, 0xab,
+	0xe0, 0x81, 0x0e, 0xb1, 0x7f, 0x5b, 0x88, 0xa3, 0x5c, 0x4e, 0x4d, 0x6d, 0x5e, 0x97, 0x3c, 0xc7,
+	0x07, 0x72, 0xb3, 0x46, 0x27, 0x50, 0xcf, 0x22, 0x81, 0x33, 0x3a, 0xce, 0xa8, 0x98, 0xe2, 0x88,
+	0xc6, 0x64, 0xee, 0x95, 0x6f, 0xc9, 0xa9, 0x56, 0xd9, 0xca, 0x22, 0xe1, 0x1b, 0xb7, 0x9e, 0xf2,
+	0x42, 0x4f, 0xa0, 0x46, 0x13, 0xdd, 0x23, 0x32, 0x23, 0x21, 0x4b, 0x26, 0x5e, 0x45, 0x77, 0x47,
+	0xd5, 0xa0, 0x81, 0x01, 0x55, 0xad, 0x49, 0x18, 0xaa, 0x84, 0xc5, 0x7c, 0x82, 0xc7, 0x2c, 0xa6,
+	0x5e, 0x55, 0xa7, 0xb6, 0x6a, 0xe0, 0x01, 0x9f, 0x1c, 0xb3, 0x98, 0xa2, 0x1f, 0xa0, 0x16, 0xd1,
+	0x31, 0xc9, 0x63, 0x89, 0xcd, 0xa5, 0xf3, 0x6a, 0x7a, 0x5b, 0xcd, 0x95, 0xa7, 0x3d, 0x57, 0x7d,
+	0x62, 0x8e, 0xeb, 0x57, 0xad, 0x9f, 0xbd, 0x1a, 0xcf, 0xa0, 0x6a, 0x9a, 0x9d, 0x44, 0x91, 0x4a,
+	0xa9, 0xe7, 0xaa, 0x70, 0xfa, 0x0c, 0x15, 0x6d, 0x38, 0x32, 0xb8, 0xaa, 0x25, 0xcf, 0xe5, 0x25,
+	0xcf, 0x93, 0x48, 0x1d, 0x61, 0x3c, 0x66, 0x61, 0x91, 0xe8, 0xba, 0x0e, 0x7d, 0x6b, 0x2d, 0x87,
+	0xd6, 0x3d, 0x30, 0xde, 0x26, 0xc7, 0xfe, 0x0e, 0x5f, 0x05, 0xa3, 0x1e, 0x7c, 0x63, 0xf3, 0x15,
+	0xc6, 0x8c, 0x26, 0x12, 0x0b, 0x16, 0x7d, 0x7e, 0xbf, 0xbc, 0x6d, 0x9d, 0xc0, 0xc7, 0x86, 0xd6,
+	0xd5, 0xac, 0x11, 0x8b, 0x96, 0xef, 0x19, 0x6a, 0x42, 0x45, 0x44, 0x02, 0xe7, 0x91, 0xc0, 0x29,
+	0x91, 0x53, 0xef, 0x81, 0xce, 0x25, 0x88, 0x48, 0x5c, 0x44, 0xe2, 0x9c, 0xc8, 0xa9, 0x2a, 0xb1,
+	0xf8, 0x49, 0x89, 0x77, 0xfe, 0xa7, 0x12, 0x8b, 0x2f, 0x4a, 0xfc, 0x06, 0x6a, 0xa6, 0x16, 0x58,
+	0xf0, 0x3c, 0x0b, 0xa9, 0xf0, 0x1e, 0x36, 0xd7, 0xda, 0xe5, 0xc3, 0xbd, 0x95, 0x89, 0x31, 0x49,
+	0x19, 0x69, 0xa6, 0x5f, 0x0d, 0x97, 0x56, 0x02, 0xbd, 0x80, 0x87, 0xf6, 0xf0, 0x6a, 0x6f, 0x92,
+	0x5f, 0xd1, 0x04, 0xcf, 0x78, 0x9e, 0x48, 0xef, 0x2b, 0xf3, 0xa4, 0x18, 0xeb, 0x28, 0x12, 0x81,
+	0xb2, 0xbd, 0x55, 0x26, 0xf5, 0xa4, 0x2c, 0xb7, 0x0e, 0xcf, 0x66, 0x44, 0x7a, 0x9e, 0x3e, 0xf0,
+	0xd6, 0xa2, 0x79, 0x34, 0xac, 0x02, 0x2c, 0xa7, 0x12, 0x8f, 0x09, 0x8b, 0x31, 0x4f, 0x69, 0xe2,
+	0x3d, 0x32, 0x01, 0xd2, 0x45, 0x12, 0x8f, 0x09, 0x8b, 0x87, 0x29, 0x4d, 0xd0, 0x1e, 0x54, 0x64,
+	0x96, 0x0b, 0x89, 0x23, 0x3e, 0x23, 0x2c, 0xf1, 0x1a, 0x5a, 0xbb, 0xac, 0xb1, 0x9e, 0x86, 0x10,
+	0x81, 0xed, 0xa5, 0x3d, 0xd0, 0x24, 0xe4, 0x91, 0x6a, 0xf5, 0xc7, 0xfa, 0x26, 0x3e, 0xbf, 0xf5,
+	0x26, 0x16, 0xbb, 0xec, 0x5b, 0x47, 0xbf, 0x4e, 0xbe, 0x84, 0x10, 0x87, 0xaa, 0x0c, 0x53, 0x7c,
+	0x45, 0x69, 0x4a, 0x62, 0x76, 0x4d, 0xbd, 0xdf, 0xe8, 0x62, 0x9d, 0x5a, 0xf1, 0xc5, 0x90, 0x28,
+	0x42, 0xbc, 0x50, 0xa9, 0x56, 0x6f, 0x1c, 0xe3, 0xc9, 0x39, 0xe7, 0xf1, 0x88, 0x4a, 0xc9, 0x92,
+	0x89, 0xe8, 0x04, 0xdd, 0xf3, 0xc5, 0x77, 0x98, 0xfe, 0x58, 0x28, 0xfa, 0x15, 0xb9, 0xb4, 0x42,
+	0xfb, 0x80, 0x74, 0x0f, 0x09, 0x8a, 0xaf, 0x5e, 0x0a, 0x2c, 0x08, 0xfe, 0xeb, 0x07, 0xe9, 0x7d,
+	0xad, 0xf3, 0x54, 0x53, 0x9d, 0x24, 0xe8, 0x8f, 0x2f, 0xc5, 0x88, 0x9c, 0x7e, 0x90, 0xe8, 0x1c,
+	0x9e, 0xa8, 0x3e, 0x0d, 0x49, 0x86, 0x25, 0xc7, 0x92, 0xc6, 0x74, 0x46, 0x65, 0x36, 0xc7, 0x82,
+	0x0a, 0xa1, 0x46, 0x94, 0xea, 0xf0, 0x84, 0xc9, 0xb9, 0xb7, 0xab, 0xdd, 0xf7, 0x2c, 0x39, 0xe0,
+	0x41, 0x41, 0x1d, 0x19, 0xe6, 0x91, 0x25, 0xa2, 0x57, 0xf0, 0xa8, 0xb8, 0xe8, 0xf6, 0xad, 0xc5,
+	0xf4, 0xa3, 0x1e, 0x4b, 0x92, 0x7b, 0xdf, 0x34, 0xd7, 0xda, 0xf7, 0xfd, 0x87, 0x96, 0x60, 0x5f,
+	0xdd, 0xbe, 0x36, 0x07, 0x1c, 0xbd, 0x81, 0xbd, 0xc2, 0xf5, 0x9a, 0x65, 0x32, 0x27, 0xf1, 0x0a,
+	0x89, 0xa6, 0x96, 0xf8, 0xda, 0x12, 0xdf, 0x19, 0xde, 0x97, 0x4a, 0xa7, 0xd0, 0x2a, 0x94, 0xbe,
+	0x1c, 0xb8, 0x4b, 0x52, 0x7b, 0x5a, 0x6a, 0xd7, 0x32, 0x7b, 0x0b, 0xa2, 0x9f, 0xc7, 0x0b, 0xad,
+	0x27, 0x50, 0xcb, 0x38, 0x97, 0x38, 0x21, 0x33, 0x2a, 0x52, 0x12, 0x52, 0xaf, 0x65, 0x1e, 0x38,
+	0x85, 0x9e, 0x15, 0x20, 0xfa, 0x0b, 0x6c, 0xc7, 0x3c, 0x24, 0x31, 0x93, 0x73, 0x1c, 0x5f, 0x62,
+	0x61, 0x0a, 0xe5, 0x7d, 0xab, 0x8b, 0xfd, 0xbb, 0x95, 0x9d, 0x34, 0xb0, 0xfc, 0x01, 0x27, 0xd1,
+	0x6b, 0x12, 0x93, 0x24, 0xa4, 0x99, 0x2d, 0xb0, 0x5f, 0x2f, 0xc4, 0x06, 0x97, 0x16, 0x6a, 0xfc,
+	0xdd, 0x81, 0x9d, 0x95, 0x4f, 0x12, 0x3a, 0x83, 0x75, 0x3d, 0xa3, 0x1c, 0xdd, 0xb6, 0xdf, 0xff,
+	0x5f, 0xef, 0x5a, 0x47, 0x0f, 0x2a, 0xad, 0xd3, 0xea, 0xc1, 0xba, 0x9e, 0x4f, 0x75, 0xa8, 0xfa,
+	0xfd, 0x1f, 0x4e, 0x46, 0x81, 0xff, 0x1e, 0x0f, 0xcf, 0x06, 0xef, 0xdd, 0x3b, 0xa8, 0x0a, 0xf7,
+	0x8f, 0x06, 0x83, 0xe1, 0x1f, 0xf0, 0xd1, 0xd9, 0x7b, 0xd7, 0x69, 0xad, 0x6f, 0x96, 0xdc, 0xd2,
+	0xfe, 0x83, 0x77, 0x27, 0x7e, 0x70, 0x71, 0x34, 0xc0, 0xa3, 0xbe, 0xff, 0xee, 0xa4, 0xdb, 0xd7,
+	0xe4, 0xd6, 0x2b, 0xd8, 0x59, 0x39, 0x0d, 0xd1, 0x06, 0xac, 0x0d, 0x8f, 0x8f, 0xdd, 0x3b, 0xa8,
+	0x0c, 0x1b, 0xbd, 0xfe, 0xf1, 0xd1, 0xc5, 0x20, 0x70, 0x1d, 0x04, 0x70, 0x6f, 0x14, 0xf8, 0x27,
+	0xdd, 0xc0, 0x2d, 0xb5, 0x9e, 0x02, 0x2c, 0xa6, 0x1c, 0xda, 0x84, 0xf5, 0xb3, 0xe1, 0x59, 0xdf,
+	0xbd, 0x83, 0x6a, 0x00, 0x6f, 0x2f, 0x74, 0xa4, 0x60, 0x30, 0x72, 0x9d, 0xd6, 0x33, 0xa8, 0xff,
+	0xe4, 0x0e, 0x2a, 0x7a, 0xd0, 0xff, 0x63, 0xe0, 0xde, 0x51, 0x5f, 0xa7, 0xa3, 0xe1, 0x99, 0xeb,
+	0x9c, 0xae, 0x6f, 0x6e, 0xb9, 0xee, 0xe9, 0xfa, 0x26, 0x72, 0xb7, 0x5b, 0x02, 0x2a, 0xcb, 0x6f,
+	0x19, 0xf2, 0x60, 0xa3, 0x98, 0x25, 0xe6, 0x0f, 0xab, 0x58, 0xa2, 0x13, 0xa8, 0xc8, 0x58, 0x14,
+	0xb5, 0x14, 0xfa, 0x8f, 0xaa, 0x7c, 0xf8, 0xf4, 0x67, 0x6e, 0x6e, 0x30, 0x18, 0x15, 0x57, 0xd4,
+	0x2f, 0xcb, 0x58, 0x14, 0x8b, 0xd6, 0x3f, 0xd6, 0xe0, 0xf1, 0xcf, 0xd4, 0x1b, 0xfd, 0x19, 0x20,
+	0x62, 0x42, 0x66, 0xec, 0x32, 0x97, 0xaa, 0x90, 0xea, 0x1d, 0xfe, 0xfd, 0x2f, 0xed, 0x9a, 0x4e,
+	0xef, 0x46, 0xc2, 0x5f, 0x92, 0x43, 0x17, 0xb0, 0xa9, 0x1e, 0x4c, 0x6e, 0xfe, 0x0a, 0x95, 0xf4,
+	0xab, 0x5f, 0x2c, 0x7d, 0x6c, 0x05, 0xfc, 0x1b, 0xa9, 0xc6, 0xdf, 0x1c, 0x80, 0x45, 0x44, 0x84,
+	0x60, 0x7d, 0x9c, 0xf1, 0x99, 0x4d, 0xa2, 0xfe, 0x46, 0x23, 0x28, 0x49, 0x6e, 0x63, 0x76, 0x7f,
+	0xc5, 0x71, 0x3a, 0x01, 0xef, 0x27, 0x32, 0x9b, 0xfb, 0x25, 0xc9, 0x1b, 0xdf, 0xc1, 0x86, 0x5d,
+	0x22, 0x17, 0xd6, 0xae, 0xe8, 0xdc, 0x86, 0x54, 0x9f, 0xe8, 0x01, 0xdc, 0xbd, 0x26, 0x71, 0x4e,
+	0x75, 0xb1, 0xaa, 0xbe, 0x59, 0x7c, 0x5f, 0x7a, 0xe9, 0x34, 0x3a, 0xb0, 0x59, 0x1c, 0x62, 0xe5,
+	0x5e, 0x6b, 0x76, 0xaf, 0x0a, 0x29, 0x49, 0xfe, 0xba, 0xfd, 0xcf, 0x4f, 0xbb, 0xce, 0xbf, 0x3e,
+	0xed, 0x3a, 0xff, 0xfe, 0xb4, 0xeb, 0xfc, 0xa9, 0x61, 0x36, 0xcf, 0xf8, 0x01, 0x49, 0xd9, 0xc1,
+	0x67, 0x7f, 0xfd, 0x97, 0xf7, 0xf4, 0xc0, 0x7d, 0xf1, 0xdf, 0x00, 0x00, 0x00, 0xff, 0xff, 0xe4,
+	0xc5, 0xfa, 0x45, 0x5e, 0x0c, 0x00, 0x00,
 }
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index ba2c909cc3..5e12c544e6 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -195,9 +195,6 @@ message MeshConfig {
   // can be configured for a single control plane.
   repeated ConfigSource config_sources = 22;
 
-  // Locality based load balancing distribution or failover settings.
-  LocalityLoadBalancerSetting locality_lb_setting = 31;
-
   // $hide_from_docs
   // This flag is used by secret discovery service(SDS).
   // If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount
@@ -221,7 +218,70 @@ message MeshConfig {
   string trust_domain = 26;
 
   // $hide_from_docs
-  // Next available field number: 32
+  // The default value for the ServiceEntry.exportTo field and services
+  // imported through container registry integrations, e.g. this applies to
+  // Kubernetes Service resources. The value is a list of namespace names and
+  // reserved namespace aliases. The allowed namespace aliases are:
+  //
+  // * - All Namespaces
+  // . - Current Namespace
+  // ~ - No Namespace
+  //
+  // If not set the system will use "*" as the default value which implies that
+  // services are exported to all namespaces.
+  //
+  // 'All namespaces' is a reasonable default for implementations that don't
+  // need to restrict access or visibility of services across namespace
+  // boundaries. If that requirement is present it is generally good practice to
+  // make the default 'Current namespace' so that services are only visible
+  // within their own namespaces by default. Operators can then expand the
+  // visibility of services to other namespaces as needed. Use of 'No Namespace'
+  // is expected to be rare but can have utility for deployments where
+  // dependency management needs to be precise even within the scope of a single
+  // namespace.
+  //
+  // For further discussion see the reference documentation for ServiceEntry,
+  // Sidecar, and Gateway.
+  repeated string default_service_export_to = 31;
+
+  // $hide_from_docs
+  // The default value for the VirtualService.exportTo field. Has the same
+  // syntax as 'default_service_export_to'.
+  //
+  // If not set the system will use "*" as the default value which implies that
+  // virtual services are exported to all namespaces
+  repeated string default_virtual_service_export_to = 32;
+
+  // $hide_from_docs
+  // The default value for the DestinationRule.exportTo field. Has the same
+  // syntax as 'default_service_export_to'.
+  //
+  // If not set the system will use "*" as the default value which implies that
+  // destination rules are exported to all namespaces
+  repeated string default_destination_rule_export_to = 33;
+
+  // $hide_from_docs
+  // The namespace to treat as the administrative root namespace for
+  // istio configuration. When processing a namespace Istio will treat
+  // declarations in the root namespace as if they belonged to each leaf
+  // namespace.
+  //
+  // The precise semantics of this processing are documented on each resource
+  // type.
+  //
+  // There is no default value for this flag in 1.1 but in later releases it
+  // is expected to default to a new namespace, "istio-config", which is
+  // maintained separately from the "istio-system" namespace where an instance
+  // of the control plane runtime is deployed. This separates the concerns of
+  // configuring the control-plane runtime from configuration of the mesh.
+  string root_namespace = 34;
+
+  // Locality based load balancing distribution or failover settings.
+  LocalityLoadBalancerSetting locality_lb_setting = 35;
+
+
+  // $hide_from_docs
+  // Next available field number: 36
 }
 
 // ConfigSource describes information about a configuration store inside a
@@ -240,60 +300,88 @@ message ConfigSource {
 }
 
 
-// The following example sets up locality weight for mesh wide service
-// Assume a service resides in "region1/zone1/*" and "region1/zone2/*",
-// and originating clusters also reside in "region1/zone1/*" and "region1/zone2/*".
-// This example specifies when clusters from "region1/zone1/*" accessing the service, 80% of the traffic
-// is shipped to "region1/zone1/*" ratings service endpoints, and the rest 20% to "region1/zone2/*".
+// Locality-weighted load balancing allows administrators to control the
+// distribution of traffic to endpoints based on the localities of where the
+// traffic originates and where it will terminate. These localities are
+// specified using arbitrary labels that designate a hierarchy of localities in
+// {region}/{zone}/{sub-zone} form. For additional detail refer to
+// https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing/locality_weight
+// The following example shows how to setup locality weights mesh-wide.
+//
+// Given a mesh with workloads and their service deployed to "us-west/zone1/*"
+// and "us-west/zone2/*". This example specifies that when traffic accessing a
+// service originates from workloads in "us-west/zone1/*", 80% of the traffic
+// will be sent to endpoints in "us-west/zone1/*", i.e the same zone, and the
+// remaining 20% will go to endpoints in "us-west/zone2/*". This setup is
+// intended to favor routing traffic to endpoint in the same locality. A similar
+// setting is specified for traffic originating in "us-west/zone2/*".
 //
 // ```yaml
 //   distribute:
-//     - from: region1/zone1/*
+//     - from: us-west/zone1/*
 //       to:
-//         "region1/zone1/*": 80
-//         "region1/zone2/*": 20
-//     - from: region1/zone2/*
+//         "us-west/zone1/*": 80
+//         "us-west/zone2/*": 20
+//     - from: us-west/zone2/*
 //       to:
-//         "region1/zone1/*": 20
-//         "region1/zone2/*": 80
+//         "us-west/zone1/*": 20
+//         "us-west/zone2/*": 80
 // ```
 //
-// The following example sets up locality failover policy for the ratings service
-// Assume a service resides in "region1" "region2" and "region3",
-// This example specifies when clusters from "region1/zone1" accessing the service,
-// if endpoints in "region1" becomes unhealthy, traffic will begin to trickle to "region2".
+// If the goal of the operator is not to distribute load across zones and
+// regions but rather to restrict the regionality of failover to meet other
+// operational requirements an operator can set a 'failover' policy instead of
+// a 'distribute' policy.
+//
+// The following example sets up a locality failover policy for regions.
+// Assume a service resides in zones within us-east, us-west & eu-west
+// this example specifies that when endpoints within us-east become unhealthy
+// traffic should failover to endpoints in any zone or sub-zone within eu-west
+// and similarly us-west should failover to us-east.
 //
 // ```yaml
 //  failover:
-//    - from: region1
-//      to: region2
+//    - from: us-east
+//      to: eu-west
+//    - from: us-west
+//      to: us-east
 // ```
 // Locality load balancing settings.
 message LocalityLoadBalancerSetting{
-  // Originating -> upstream cluster locality weight set, support wildcard matching '*'
-  // '*' matches all localities
-  // 'region1/*' matches all zones in region1
+  // Describes how traffic originating in the 'from' zone or sub-zone is
+  // distributed over a set of 'to' zones. Syntax for specifying a zone is
+  // {region}/{zone}/{sub-zone} and terminal wildcards are allowed on any
+  // segment of the specification. Examples:
+  // * - matches all localities
+  // us-west/* - all zones and sub-zones within the us-west region
+  // us-west/zone-1/* - all sub-zones within us-west/zone-1
   message Distribute{
       // Originating locality, '/' separated, e.g. 'region/zone/sub_zone'.
       string from = 1;
 
-      // Upstream locality to loadbalancing weight map. The sum of all weights should be == 100.
-      // Should assign load balancing weight for all localities, otherwise the traffic are not routed
-      // following the percentage of weight.
+      // Map of upstream localities to traffic distribution weights. The sum of
+      // all weights should be == 100. Any locality not assigned a weight will
+      // receive no traffic.
       map<string, uint32> to = 2;
   };
 
-  // Specify the traffic failover policy.
-  // As zone and sub_zone failover is supported by default, only region can be specified here.
+  // Specify the traffic failover policy across regions. Since zone and sub-zone
+  // failover is supported by default this only needs to be specified for
+  // regions when the operator needs to constrain traffic failover so that
+  // the default behavior of failing over to any endpoint globally does not
+  // apply. This is useful when failing over traffic across regions would not
+  // improve service health or may need to be restricted for other reasons
+  // like regulatory controls.
   message Failover{
       // Originating region.
       string from = 1;
 
-      // Destination region the traffic will fail over to when endpoints in local region becomes unhealthy.
+      // Destination region the traffic will fail over to when endpoints in
+      // the 'from' region becomes unhealthy.
       string to = 2;
   };
 
-  // Optional: only distribute or failover can be set.
+  // Optional: only one of distribute or failover can be set.
   // Explicitly specify loadbalancing weight across different zones and geographical locations.
   // Refer to [Locality weighted load balancing](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing.html?highlight=load_balancing_weight#locality-weighted-load-balancing)
   // If empty, the locality weight is set according to the endpoints number within it.
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index b2d788735e..beeb855225 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -86,31 +86,49 @@ <h2 id="ConfigSource">ConfigSource</h2>
 </section>
 <h2 id="LocalityLoadBalancerSetting">LocalityLoadBalancerSetting</h2>
 <section>
-<p>The following example sets up locality weight for mesh wide service
-Assume a service resides in &ldquo;region1/zone1/<em>&rdquo; and &ldquo;region1/zone2/</em>&rdquo;,
-and originating clusters also reside in &ldquo;region1/zone1/<em>&rdquo; and &ldquo;region1/zone2/</em>&rdquo;.
-This example specifies when clusters from &ldquo;region1/zone1/<em>&rdquo; accessing the service, 80% of the traffic
-is shipped to &ldquo;region1/zone1/</em>&rdquo; ratings service endpoints, and the rest 20% to &ldquo;region1/zone2/*&rdquo;.</p>
+<p>Locality-weighted load balancing allows administrators to control the
+distribution of traffic to endpoints based on the localities of where the
+traffic originates and where it will terminate. These localities are
+specified using arbitrary labels that designate a hierarchy of localities in
+&lbrace;region}/&lbrace;zone}/&lbrace;sub-zone} form. For additional detail refer to
+https://www.envoyproxy.io/docs/envoy/latest/intro/arch<em>overview/load</em>balancing/locality_weight
+The following example shows how to setup locality weights mesh-wide.</p>
+
+<p>Given a mesh with workloads and their service deployed to &ldquo;us-west/zone1/<em>&rdquo;
+and &ldquo;us-west/zone2/</em>&rdquo;. This example specifies that when traffic accessing a
+service originates from workloads in &ldquo;us-west/zone1/<em>&rdquo;, 80% of the traffic
+will be sent to endpoints in &ldquo;us-west/zone1/</em>&rdquo;, i.e the same zone, and the
+remaining 20% will go to endpoints in &ldquo;us-west/zone2/<em>&rdquo;. This setup is
+intended to favor routing traffic to endpoint in the same locality. A similar
+setting is specified for traffic originating in &ldquo;us-west/zone2/</em>&rdquo;.</p>
 
 <pre><code class="language-yaml">  distribute:
-    - from: region1/zone1/*
+    - from: us-west/zone1/*
       to:
-        &quot;region1/zone1/*&quot;: 80
-        &quot;region1/zone2/*&quot;: 20
-    - from: region1/zone2/*
+        &quot;us-west/zone1/*&quot;: 80
+        &quot;us-west/zone2/*&quot;: 20
+    - from: us-west/zone2/*
       to:
-        &quot;region1/zone1/*&quot;: 20
-        &quot;region1/zone2/*&quot;: 80
+        &quot;us-west/zone1/*&quot;: 20
+        &quot;us-west/zone2/*&quot;: 80
 </code></pre>
 
-<p>The following example sets up locality failover policy for the ratings service
-Assume a service resides in &ldquo;region1&rdquo; &ldquo;region2&rdquo; and &ldquo;region3&rdquo;,
-This example specifies when clusters from &ldquo;region1/zone1&rdquo; accessing the service,
-if endpoints in &ldquo;region1&rdquo; becomes unhealthy, traffic will begin to trickle to &ldquo;region2&rdquo;.</p>
+<p>If the goal of the operator is not to distribute load across zones and
+regions but rather to restrict the regionality of failover to meet other
+operational requirements an operator can set a &lsquo;failover&rsquo; policy instead of
+a &lsquo;distribute&rsquo; policy.</p>
+
+<p>The following example sets up a locality failover policy for regions.
+Assume a service resides in zones within us-east, us-west &amp; eu-west
+this example specifies that when endpoints within us-east become unhealthy
+traffic should failover to endpoints in any zone or sub-zone within eu-west
+and similarly us-west should failover to us-east.</p>
 
 <pre><code class="language-yaml"> failover:
-   - from: region1
-     to: region2
+   - from: us-east
+     to: eu-west
+   - from: us-west
+     to: us-east
 </code></pre>
 
 <p>Locality load balancing settings.</p>
@@ -128,7 +146,7 @@ <h2 id="LocalityLoadBalancerSetting">LocalityLoadBalancerSetting</h2>
 <td><code>distribute</code></td>
 <td><code><a href="#LocalityLoadBalancerSetting-Distribute">LocalityLoadBalancerSetting.Distribute[]</a></code></td>
 <td>
-<p>Optional: only distribute or failover can be set.
+<p>Optional: only one of distribute or failover can be set.
 Explicitly specify loadbalancing weight across different zones and geographical locations.
 Refer to <a href="https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing.html?highlight=load_balancing_weight#locality-weighted-load-balancing">Locality weighted load balancing</a>
 If empty, the locality weight is set according to the endpoints number within it.</p>
@@ -151,9 +169,13 @@ <h2 id="LocalityLoadBalancerSetting">LocalityLoadBalancerSetting</h2>
 </section>
 <h2 id="LocalityLoadBalancerSetting-Distribute">LocalityLoadBalancerSetting.Distribute</h2>
 <section>
-<p>Originating -&gt; upstream cluster locality weight set, support wildcard matching &lsquo;<em>&rsquo;
-&lsquo;</em>&rsquo; matches all localities
-&lsquo;region1/*&rsquo; matches all zones in region1</p>
+<p>Describes how traffic originating in the &lsquo;from&rsquo; zone or sub-zone is
+distributed over a set of &lsquo;to&rsquo; zones. Syntax for specifying a zone is
+&lbrace;region}/&lbrace;zone}/&lbrace;sub-zone} and terminal wildcards are allowed on any
+segment of the specification. Examples:
+* - matches all localities
+us-west/* - all zones and sub-zones within the us-west region
+us-west/zone-1/* - all sub-zones within us-west/zone-1</p>
 
 <table class="message-fields">
 <thead>
@@ -176,9 +198,9 @@ <h2 id="LocalityLoadBalancerSetting-Distribute">LocalityLoadBalancerSetting.Dist
 <td><code>to</code></td>
 <td><code>map&lt;string,&nbsp;uint32&gt;</code></td>
 <td>
-<p>Upstream locality to loadbalancing weight map. The sum of all weights should be == 100.
-Should assign load balancing weight for all localities, otherwise the traffic are not routed
-following the percentage of weight.</p>
+<p>Map of upstream localities to traffic distribution weights. The sum of
+all weights should be == 100. Any locality not assigned a weight will
+receive no traffic.</p>
 
 </td>
 </tr>
@@ -187,8 +209,13 @@ <h2 id="LocalityLoadBalancerSetting-Distribute">LocalityLoadBalancerSetting.Dist
 </section>
 <h2 id="LocalityLoadBalancerSetting-Failover">LocalityLoadBalancerSetting.Failover</h2>
 <section>
-<p>Specify the traffic failover policy.
-As zone and sub_zone failover is supported by default, only region can be specified here.</p>
+<p>Specify the traffic failover policy across regions. Since zone and sub-zone
+failover is supported by default this only needs to be specified for
+regions when the operator needs to constrain traffic failover so that
+the default behavior of failing over to any endpoint globally does not
+apply. This is useful when failing over traffic across regions would not
+improve service health or may need to be restricted for other reasons
+like regulatory controls.</p>
 
 <table class="message-fields">
 <thead>
@@ -211,7 +238,8 @@ <h2 id="LocalityLoadBalancerSetting-Failover">LocalityLoadBalancerSetting.Failov
 <td><code>to</code></td>
 <td><code>string</code></td>
 <td>
-<p>Destination region the traffic will fail over to when endpoints in local region becomes unhealthy.</p>
+<p>Destination region the traffic will fail over to when endpoints in
+the &lsquo;from&rsquo; region becomes unhealthy.</p>
 
 </td>
 </tr>
@@ -438,14 +466,6 @@ <h2 id="MeshConfig">MeshConfig</h2>
 rules, and other Istio configuration artifacts. Multiple data sources
 can be configured for a single control plane.</p>
 
-</td>
-</tr>
-<tr id="MeshConfig-locality_lb_setting">
-<td><code>localityLbSetting</code></td>
-<td><code><a href="#LocalityLoadBalancerSetting">LocalityLoadBalancerSetting</a></code></td>
-<td>
-<p>Locality based load balancing distribution or failover settings.</p>
-
 </td>
 </tr>
 <tr id="MeshConfig-trust_domain">
@@ -456,6 +476,14 @@ <h2 id="MeshConfig">MeshConfig</h2>
 Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
 Fallback to old identity format(without trust domain) if not set.</p>
 
+</td>
+</tr>
+<tr id="MeshConfig-locality_lb_setting">
+<td><code>localityLbSetting</code></td>
+<td><code><a href="#LocalityLoadBalancerSetting">LocalityLoadBalancerSetting</a></code></td>
+<td>
+<p>Locality based load balancing distribution or failover settings.</p>
+
 </td>
 </tr>
 </tbody>
diff --git a/networking/v1alpha3/destination_rule.pb.go b/networking/v1alpha3/destination_rule.pb.go
index d857346f74..e6ec78ed48 100644
--- a/networking/v1alpha3/destination_rule.pb.go
+++ b/networking/v1alpha3/destination_rule.pb.go
@@ -250,11 +250,11 @@ type DestinationRule struct {
 	// One or more named sets that represent individual versions of a
 	// service. Traffic policies can be overridden at subset level.
 	Subsets []*Subset `protobuf:"bytes,3,rep,name=subsets" json:"subsets,omitempty"`
-	// The visibility setting associated with this DestinationRule. Set to
-	// PRIVATE if this destination rule should not be exported, i.e. restrict
-	// the applicability of this destination rule to only workloads in the same
-	// namespace as the destination rule.
-	ConfigScope ConfigScope `protobuf:"varint,4,opt,name=config_scope,json=configScope,proto3,enum=istio.networking.v1alpha3.ConfigScope" json:"config_scope,omitempty"`
+	// The resolution of a DestinationRule to apply to a service occurs in the
+	// context of a hierarchy of namespaces. This rule control whether those
+	// namespaces are allowed to select this rule.
+	//
+	ExportTo []string `protobuf:"bytes,4,rep,name=exportTo" json:"exportTo,omitempty"`
 }
 
 func (m *DestinationRule) Reset()                    { *m = DestinationRule{} }
@@ -283,11 +283,11 @@ func (m *DestinationRule) GetSubsets() []*Subset {
 	return nil
 }
 
-func (m *DestinationRule) GetConfigScope() ConfigScope {
+func (m *DestinationRule) GetExportTo() []string {
 	if m != nil {
-		return m.ConfigScope
+		return m.ExportTo
 	}
-	return ConfigScope_PUBLIC
+	return nil
 }
 
 // Traffic policies to apply for a specific destination, across all
@@ -1340,10 +1340,20 @@ func (m *DestinationRule) MarshalTo(dAtA []byte) (int, error) {
 			i += n
 		}
 	}
-	if m.ConfigScope != 0 {
-		dAtA[i] = 0x20
-		i++
-		i = encodeVarintDestinationRule(dAtA, i, uint64(m.ConfigScope))
+	if len(m.ExportTo) > 0 {
+		for _, s := range m.ExportTo {
+			dAtA[i] = 0x22
+			i++
+			l = len(s)
+			for l >= 1<<7 {
+				dAtA[i] = uint8(uint64(l)&0x7f | 0x80)
+				l >>= 7
+				i++
+			}
+			dAtA[i] = uint8(l)
+			i++
+			i += copy(dAtA[i:], s)
+		}
 	}
 	return i, nil
 }
@@ -1990,8 +2000,11 @@ func (m *DestinationRule) Size() (n int) {
 			n += 1 + l + sovDestinationRule(uint64(l))
 		}
 	}
-	if m.ConfigScope != 0 {
-		n += 1 + sovDestinationRule(uint64(m.ConfigScope))
+	if len(m.ExportTo) > 0 {
+		for _, s := range m.ExportTo {
+			l = len(s)
+			n += 1 + l + sovDestinationRule(uint64(l))
+		}
 	}
 	return n
 }
@@ -2404,10 +2417,10 @@ func (m *DestinationRule) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConfigScope", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExportTo", wireType)
 			}
-			m.ConfigScope = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowDestinationRule
@@ -2417,11 +2430,21 @@ func (m *DestinationRule) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ConfigScope |= (ConfigScope(b) & 0x7F) << shift
+				stringLen |= (uint64(b) & 0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthDestinationRule
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExportTo = append(m.ExportTo, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipDestinationRule(dAtA[iNdEx:])
@@ -4504,94 +4527,93 @@ func init() {
 }
 
 var fileDescriptorDestinationRule = []byte{
-	// 1418 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x57, 0xcd, 0x6e, 0x1b, 0xb7,
-	0x16, 0xb6, 0x7e, 0x63, 0x1f, 0xd9, 0xb2, 0xcc, 0x6b, 0xe4, 0x2a, 0xba, 0x80, 0xe3, 0x08, 0x17,
-	0x37, 0xbe, 0x69, 0x33, 0xaa, 0x1d, 0x14, 0x48, 0x13, 0xa4, 0x88, 0x65, 0x1b, 0x91, 0x1b, 0xd9,
-	0x12, 0x28, 0x19, 0x28, 0xb2, 0x19, 0x50, 0x23, 0x5a, 0x62, 0x3c, 0x1a, 0x4e, 0x49, 0x8e, 0x6a,
-	0xe7, 0x19, 0xba, 0x0e, 0xba, 0xed, 0xa6, 0xcf, 0x52, 0x74, 0xd5, 0x6d, 0xbb, 0x69, 0x91, 0x17,
-	0xe8, 0xaa, 0x9b, 0x2e, 0x8a, 0x82, 0x1c, 0xea, 0xc7, 0x89, 0x23, 0xc7, 0x48, 0xb3, 0x23, 0x79,
-	0xbe, 0xef, 0x90, 0x3c, 0xe7, 0x9b, 0x73, 0x38, 0x70, 0x27, 0xa0, 0xea, 0x6b, 0x2e, 0x4e, 0x58,
-	0xd0, 0xab, 0x0c, 0x37, 0x89, 0x1f, 0xf6, 0xc9, 0xbd, 0x4a, 0x97, 0x4a, 0xc5, 0x02, 0xa2, 0x18,
-	0x0f, 0x5c, 0x11, 0xf9, 0xd4, 0x09, 0x05, 0x57, 0x1c, 0xdd, 0x60, 0x52, 0x31, 0xee, 0x4c, 0x18,
-	0xce, 0x88, 0x51, 0x5a, 0xeb, 0x71, 0xde, 0xf3, 0x69, 0xc5, 0x00, 0x3b, 0xd1, 0x71, 0xa5, 0x1b,
-	0x09, 0xc3, 0x8f, 0xa9, 0xa5, 0xff, 0x5f, 0xb4, 0xcd, 0x90, 0x09, 0x15, 0x11, 0xdf, 0x95, 0x54,
-	0x0c, 0x99, 0x67, 0x77, 0x29, 0xdd, 0xba, 0x08, 0x2a, 0x59, 0x97, 0x7a, 0x44, 0x58, 0xc8, 0x6a,
-	0x8f, 0xf7, 0xb8, 0x19, 0x56, 0xf4, 0x28, 0x5e, 0x2d, 0xff, 0x95, 0x80, 0xe5, 0xdd, 0xc9, 0xc9,
-	0x71, 0xe4, 0x53, 0x84, 0x20, 0xdd, 0xe7, 0x52, 0x15, 0x13, 0xeb, 0x89, 0x8d, 0x05, 0x6c, 0xc6,
-	0xa8, 0x01, 0x79, 0x25, 0xc8, 0xf1, 0x31, 0xf3, 0xdc, 0x90, 0xfb, 0xcc, 0x3b, 0x2b, 0x26, 0xd7,
-	0x13, 0x1b, 0xb9, 0xad, 0x0d, 0xe7, 0xad, 0xf7, 0x73, 0xda, 0x31, 0xa1, 0x69, 0xf0, 0x78, 0x49,
-	0x4d, 0x4f, 0xd1, 0x43, 0xb8, 0x26, 0xa3, 0x8e, 0xa4, 0x4a, 0x16, 0x53, 0xeb, 0xa9, 0x8d, 0xdc,
-	0xd6, 0xad, 0x19, 0x9e, 0x5a, 0x06, 0x89, 0x47, 0x0c, 0xb4, 0x0f, 0x8b, 0x1e, 0x0f, 0x8e, 0x59,
-	0xcf, 0x95, 0x1e, 0x0f, 0x69, 0x31, 0xbd, 0x9e, 0xd8, 0xc8, 0x6f, 0xfd, 0x6f, 0x86, 0x87, 0x1d,
-	0x03, 0x6f, 0x69, 0x34, 0xce, 0x79, 0x93, 0x49, 0xf9, 0x97, 0x2c, 0x2c, 0x9d, 0x3b, 0x28, 0x6a,
-	0xc3, 0x92, 0xcf, 0x49, 0xd7, 0xed, 0x10, 0x9f, 0x04, 0x1e, 0x15, 0x26, 0x0e, 0xb9, 0xad, 0xca,
-	0x0c, 0xef, 0x75, 0x4e, 0xba, 0x55, 0x0b, 0x6f, 0x51, 0xa5, 0x58, 0xd0, 0x93, 0x78, 0xd1, 0x9f,
-	0x5a, 0x45, 0xcf, 0x60, 0xd9, 0xe3, 0x41, 0x40, 0x3d, 0x23, 0x90, 0x90, 0x73, 0xdf, 0x46, 0x70,
-	0x73, 0xf6, 0xa9, 0x2d, 0xa3, 0xc9, 0xb9, 0x3f, 0xf6, 0x9c, 0xf7, 0xce, 0xad, 0xa3, 0x2f, 0x61,
-	0x85, 0x47, 0xca, 0x67, 0x54, 0xb8, 0x5d, 0xaa, 0x62, 0x43, 0x31, 0x65, 0xbc, 0x7f, 0x34, 0xc3,
-	0x7b, 0x23, 0xe6, 0xec, 0x8e, 0x28, 0xb8, 0xc0, 0x5f, 0x5b, 0x41, 0xf7, 0x21, 0xa5, 0x7c, 0x69,
-	0xe2, 0x9b, 0x9b, 0x19, 0xdf, 0x76, 0xbd, 0x35, 0x3e, 0x9e, 0xa6, 0xa0, 0xe7, 0xf0, 0xaf, 0x90,
-	0x0b, 0xe5, 0xfa, 0x74, 0x48, 0xb5, 0x5a, 0x63, 0x5b, 0x31, 0x63, 0x72, 0xfd, 0xe0, 0x5d, 0x55,
-	0xe3, 0x34, 0xb9, 0x50, 0xe7, 0x75, 0xb4, 0xa2, 0xdd, 0xd6, 0xb5, 0xd7, 0xd1, 0x86, 0xa5, 0x97,
-	0x29, 0x58, 0x79, 0x03, 0x88, 0x1e, 0x42, 0x5a, 0x43, 0x6d, 0xfa, 0x6e, 0xcf, 0xd8, 0x52, 0x73,
-	0x5b, 0xd4, 0xa7, 0x9e, 0xe2, 0x02, 0x1b, 0xd2, 0x9b, 0x22, 0x48, 0x7e, 0x20, 0x11, 0xa4, 0x3e,
-	0xa8, 0x08, 0xd2, 0xff, 0xa0, 0x08, 0x32, 0x57, 0x16, 0x41, 0xf9, 0xf7, 0x04, 0x64, 0xe3, 0x6f,
-	0x57, 0x17, 0x95, 0x80, 0x0c, 0xe8, 0xa8, 0xa8, 0xe8, 0x31, 0xda, 0x83, 0xac, 0x4f, 0x3a, 0xd4,
-	0x97, 0xc5, 0xa4, 0x91, 0xc5, 0xdd, 0x4b, 0x4b, 0x80, 0x53, 0x37, 0xf8, 0xbd, 0x40, 0x89, 0x33,
-	0x6c, 0xc9, 0x17, 0xd4, 0xa6, 0xd4, 0x7b, 0xd5, 0xa6, 0xd2, 0x67, 0x90, 0x9b, 0xda, 0x07, 0x15,
-	0x20, 0x75, 0x42, 0xcf, 0xec, 0xc9, 0xf5, 0x10, 0xad, 0x42, 0x66, 0x48, 0xfc, 0x88, 0x1a, 0x55,
-	0x2c, 0xe0, 0x78, 0xf2, 0x20, 0x79, 0x3f, 0x51, 0xfe, 0x3e, 0x03, 0xab, 0x17, 0x09, 0x01, 0x61,
-	0xc8, 0x4a, 0x36, 0x08, 0xfd, 0x38, 0x02, 0xf9, 0xad, 0xfb, 0x57, 0x54, 0x92, 0xd3, 0x32, 0xec,
-	0x7a, 0xb5, 0x36, 0x87, 0xad, 0x27, 0x74, 0x62, 0xe4, 0x24, 0x99, 0x54, 0x34, 0x50, 0x6e, 0x9f,
-	0xc8, 0xbe, 0x95, 0xe9, 0xe3, 0xab, 0x3a, 0xdf, 0x19, 0xbb, 0xa9, 0x11, 0xd9, 0x37, 0x9b, 0xe4,
-	0xbd, 0x73, 0x6b, 0xa5, 0x3f, 0x92, 0x50, 0x78, 0x1d, 0x86, 0xee, 0x40, 0xa1, 0xaf, 0x54, 0xe8,
-	0xf6, 0x29, 0xe9, 0x52, 0xe1, 0x4e, 0x32, 0xac, 0x1d, 0x68, 0x4b, 0xcd, 0x18, 0x0e, 0x75, 0xb6,
-	0x03, 0xc8, 0x19, 0xac, 0xc7, 0xf9, 0x09, 0xa3, 0xf6, 0xa4, 0x4f, 0xdf, 0xf7, 0xa4, 0x4e, 0xad,
-	0xdd, 0x6e, 0xee, 0x18, 0x97, 0xb5, 0x39, 0x0c, 0x7a, 0x87, 0x78, 0x86, 0xfe, 0x0b, 0x4b, 0x91,
-	0xa4, 0xae, 0xe4, 0x91, 0xf0, 0xa8, 0xcb, 0x42, 0xa3, 0x8a, 0xf9, 0xda, 0x1c, 0xce, 0x45, 0x92,
-	0xb6, 0xcc, 0xea, 0x7e, 0x88, 0xee, 0xc0, 0xca, 0x80, 0x05, 0x6c, 0x10, 0x0d, 0x5c, 0xc1, 0x82,
-	0x9e, 0x2b, 0xd9, 0x8b, 0xb8, 0x9f, 0xa4, 0xf1, 0xb2, 0x35, 0x60, 0x16, 0xf4, 0x5a, 0xec, 0x05,
-	0x2d, 0xf5, 0x00, 0x26, 0xbb, 0x5d, 0xa8, 0x68, 0x04, 0xe9, 0x90, 0xa8, 0xbe, 0xd5, 0x85, 0x19,
-	0xa3, 0x4d, 0x48, 0x29, 0x35, 0xfa, 0xd0, 0x6f, 0x38, 0x71, 0xd3, 0x77, 0x46, 0x4d, 0xdf, 0xd9,
-	0xb5, 0x4d, 0xbf, 0x9a, 0xfe, 0xf6, 0xd7, 0x9b, 0x09, 0xac, 0xb1, 0x55, 0x80, 0x79, 0x9d, 0x4d,
-	0xf7, 0x84, 0x9e, 0x95, 0x6b, 0x30, 0x3f, 0x4a, 0x3d, 0x5a, 0x86, 0x1c, 0x6e, 0x1c, 0x1d, 0xee,
-	0xba, 0xb8, 0x51, 0xdd, 0x3f, 0x2c, 0xcc, 0xa1, 0x3c, 0x40, 0x7d, 0x6f, 0xbb, 0xd5, 0x76, 0x77,
-	0x1a, 0x87, 0x87, 0x85, 0x04, 0x02, 0xc8, 0xe2, 0xed, 0xc3, 0xdd, 0xc6, 0x41, 0x21, 0xa9, 0xc1,
-	0xcd, 0xed, 0x56, 0xab, 0x5d, 0xc3, 0x8d, 0xa3, 0x27, 0xb5, 0x42, 0xaa, 0x9a, 0x83, 0x05, 0xbf,
-	0x63, 0x3f, 0x91, 0xf2, 0xcb, 0x2c, 0x5c, 0xbf, 0xb8, 0xb2, 0xa0, 0x06, 0xa4, 0x94, 0x17, 0xda,
-	0xba, 0xf9, 0xe8, 0xca, 0x95, 0xc9, 0x69, 0xef, 0x34, 0xa7, 0xca, 0x80, 0x17, 0x22, 0x0c, 0x69,
-	0x9d, 0x17, 0x9b, 0xf2, 0xcf, 0xaf, 0xee, 0x51, 0x47, 0x7d, 0xec, 0xd2, 0xf8, 0x2a, 0xfd, 0x99,
-	0x84, 0xdc, 0xd4, 0x46, 0xe8, 0x36, 0x2c, 0x0f, 0xc8, 0xa9, 0x3b, 0x29, 0x8a, 0xd2, 0x5c, 0x20,
-	0x83, 0xf3, 0x03, 0x72, 0x3a, 0x71, 0x2b, 0x51, 0x75, 0x5c, 0x83, 0x5d, 0xc5, 0x06, 0x94, 0x47,
-	0xca, 0x9e, 0xeb, 0xed, 0xa9, 0x19, 0xd7, 0xda, 0x76, 0x4c, 0x40, 0x1c, 0x96, 0x94, 0x17, 0xba,
-	0x27, 0x94, 0x86, 0xc4, 0x67, 0x43, 0x6a, 0x93, 0xfb, 0xc5, 0x7b, 0xc5, 0xca, 0x69, 0x7b, 0xe1,
-	0xd3, 0x91, 0x47, 0xbc, 0xa8, 0xa6, 0x66, 0xa5, 0x6f, 0x12, 0xb0, 0x38, 0x6d, 0x46, 0xd7, 0x21,
-	0x1b, 0x0a, 0xde, 0xa1, 0xf1, 0x2d, 0x97, 0xb0, 0x9d, 0xa1, 0xbb, 0x90, 0xd6, 0xb7, 0xba, 0xfc,
-	0x4a, 0x06, 0x86, 0x3e, 0x85, 0x79, 0x16, 0x28, 0x2a, 0x86, 0xe4, 0x72, 0x81, 0xe2, 0x31, 0xb4,
-	0xf4, 0x73, 0x02, 0x16, 0xa7, 0x73, 0x82, 0x1e, 0x42, 0x49, 0x67, 0x65, 0xd3, 0xd5, 0x39, 0x08,
-	0x69, 0xd0, 0xd5, 0x9f, 0x92, 0xa0, 0x5f, 0x45, 0x54, 0xaa, 0x51, 0x22, 0xfe, 0x6d, 0x10, 0x07,
-	0xe4, 0xb4, 0x19, 0xdb, 0xb1, 0x35, 0xa3, 0x8f, 0x01, 0x69, 0xd3, 0x96, 0x21, 0x8f, 0x49, 0x49,
-	0x43, 0x32, 0xe5, 0x65, 0xeb, 0x80, 0x9c, 0x8e, 0xd1, 0x8f, 0xe0, 0x3f, 0xd3, 0x38, 0x37, 0xa4,
-	0x62, 0x2a, 0xeb, 0xe6, 0x16, 0x19, 0x5c, 0x1c, 0x4c, 0x18, 0x4d, 0x2a, 0x26, 0xc1, 0x47, 0x37,
-	0x21, 0x17, 0xd3, 0x95, 0x60, 0x34, 0x7e, 0xd9, 0x64, 0x30, 0x18, 0xb8, 0x59, 0x29, 0x7f, 0x97,
-	0x84, 0xc2, 0xeb, 0x4d, 0x11, 0xdd, 0x05, 0xa4, 0xcb, 0x21, 0xf5, 0x22, 0xc5, 0x86, 0xd4, 0xa5,
-	0x42, 0x70, 0x31, 0xba, 0xd7, 0xca, 0x94, 0x65, 0xcf, 0x18, 0xce, 0x85, 0x35, 0xf9, 0xce, 0x61,
-	0x45, 0x4f, 0x00, 0x75, 0x88, 0xa4, 0x2e, 0x7d, 0x6e, 0x5f, 0x08, 0x26, 0x95, 0x97, 0xe6, 0xa5,
-	0xa0, 0x49, 0x7b, 0x96, 0xa3, 0x25, 0x8a, 0x3e, 0x81, 0x55, 0x7d, 0xc9, 0xb1, 0x9f, 0x90, 0x0a,
-	0x8f, 0x06, 0xca, 0xde, 0x16, 0x0d, 0xc8, 0xe9, 0x08, 0xde, 0x8c, 0x2d, 0x3a, 0x07, 0x03, 0x16,
-	0xe8, 0x3a, 0xee, 0xab, 0xfe, 0x18, 0x9f, 0x89, 0x73, 0x30, 0x60, 0x41, 0xcd, 0x18, 0x2c, 0xba,
-	0xfc, 0xa3, 0xfe, 0xf8, 0x26, 0xcd, 0x1e, 0x55, 0x21, 0x3d, 0xe0, 0xdd, 0x51, 0x6b, 0x73, 0xde,
-	0xed, 0x89, 0xa0, 0xc7, 0x9a, 0x85, 0x0d, 0xd7, 0x84, 0xd8, 0x67, 0xba, 0x91, 0x79, 0x54, 0x28,
-	0x76, 0xcc, 0x3c, 0xa2, 0x46, 0x0d, 0x76, 0x25, 0xb6, 0xec, 0x4c, 0x0c, 0x3a, 0x8f, 0xa1, 0x60,
-	0x43, 0xa2, 0xa8, 0xae, 0x92, 0x26, 0x48, 0x0b, 0x18, 0xec, 0xd2, 0x53, 0x7a, 0xa6, 0x0b, 0x82,
-	0x47, 0xa6, 0x7d, 0xc5, 0xc9, 0x5e, 0xc0, 0x79, 0x8f, 0x4c, 0x39, 0x92, 0xba, 0x03, 0xc8, 0xa8,
-	0xa3, 0xe3, 0xe1, 0x12, 0x5f, 0x99, 0x1e, 0x16, 0xbf, 0x53, 0x17, 0xf0, 0xb2, 0x35, 0x6c, 0xfb,
-	0x4a, 0xb7, 0x30, 0xa9, 0x9f, 0x02, 0x32, 0x60, 0xc5, 0x6c, 0xfc, 0x14, 0x90, 0x01, 0x2b, 0x3f,
-	0x86, 0x6b, 0xf6, 0x1e, 0x28, 0x07, 0xd7, 0x76, 0xf7, 0x5b, 0xdb, 0xd5, 0xfa, 0x5e, 0x61, 0x4e,
-	0x57, 0xe2, 0xd6, 0xfe, 0x41, 0xb3, 0xbe, 0x17, 0x57, 0xe5, 0x83, 0xa3, 0xf6, 0xd1, 0x76, 0xbd,
-	0x90, 0x44, 0x05, 0x58, 0xdc, 0x6f, 0xb5, 0xf7, 0x1b, 0xae, 0x5d, 0x49, 0x55, 0x9d, 0x1f, 0x5e,
-	0xad, 0x25, 0x7e, 0x7a, 0xb5, 0x96, 0xf8, 0xed, 0xd5, 0x5a, 0xe2, 0xd9, 0x7a, 0x1c, 0x3b, 0xc6,
-	0x2b, 0x24, 0x64, 0x95, 0x0b, 0x7e, 0xeb, 0x3a, 0x59, 0xa3, 0x80, 0x7b, 0x7f, 0x07, 0x00, 0x00,
-	0xff, 0xff, 0x4e, 0xda, 0x16, 0xb0, 0x86, 0x0e, 0x00, 0x00,
+	// 1393 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x57, 0x4f, 0x6f, 0x1b, 0x45,
+	0x14, 0x8f, 0xff, 0x36, 0x7e, 0x4e, 0x1c, 0x67, 0x88, 0x8a, 0x6b, 0xa4, 0x34, 0x58, 0x88, 0x86,
+	0x42, 0xd7, 0x24, 0x15, 0x52, 0x69, 0x55, 0xd4, 0x38, 0xb1, 0xea, 0x50, 0x27, 0xb6, 0xc6, 0x8e,
+	0x84, 0x7a, 0x59, 0x8d, 0xd7, 0x13, 0x7b, 0x9a, 0xf5, 0xce, 0xb2, 0x33, 0x6b, 0x92, 0x7e, 0x06,
+	0xce, 0x15, 0x57, 0x2e, 0x7c, 0x16, 0xc4, 0x05, 0xae, 0x70, 0x01, 0xf5, 0x0b, 0x70, 0xe2, 0xc2,
+	0x09, 0xcd, 0xec, 0xac, 0xed, 0xb4, 0x69, 0xd2, 0x28, 0xf4, 0x36, 0x3b, 0xef, 0xfd, 0x7e, 0x33,
+	0xf3, 0x7e, 0x6f, 0xde, 0x9b, 0x85, 0xdb, 0x1e, 0x95, 0xdf, 0xf1, 0xe0, 0x88, 0x79, 0x83, 0xea,
+	0x78, 0x83, 0xb8, 0xfe, 0x90, 0xdc, 0xad, 0xf6, 0xa9, 0x90, 0xcc, 0x23, 0x92, 0x71, 0xcf, 0x0e,
+	0x42, 0x97, 0x5a, 0x7e, 0xc0, 0x25, 0x47, 0x37, 0x98, 0x90, 0x8c, 0x5b, 0x53, 0x84, 0x15, 0x23,
+	0xca, 0xab, 0x03, 0xce, 0x07, 0x2e, 0xad, 0x6a, 0xc7, 0x5e, 0x78, 0x58, 0xed, 0x87, 0x81, 0xc6,
+	0x47, 0xd0, 0xf2, 0x27, 0x67, 0x2d, 0x33, 0x66, 0x81, 0x0c, 0x89, 0x6b, 0x0b, 0x1a, 0x8c, 0x99,
+	0x63, 0x56, 0x29, 0xaf, 0x0c, 0xf8, 0x80, 0xeb, 0x61, 0x55, 0x8d, 0xa2, 0xd9, 0xca, 0xaf, 0x09,
+	0x58, 0xda, 0x99, 0x6e, 0x0b, 0x87, 0x2e, 0x45, 0x08, 0xd2, 0x43, 0x2e, 0x64, 0x29, 0xb1, 0x96,
+	0x58, 0xcf, 0x61, 0x3d, 0x46, 0x2d, 0x28, 0xc8, 0x80, 0x1c, 0x1e, 0x32, 0xc7, 0xf6, 0xb9, 0xcb,
+	0x9c, 0x93, 0x52, 0x72, 0x2d, 0xb1, 0x9e, 0xdf, 0x5c, 0xb7, 0xde, 0xb8, 0x79, 0xab, 0x1b, 0x01,
+	0xda, 0xda, 0x1f, 0x2f, 0xca, 0xd9, 0x4f, 0xf4, 0x00, 0xae, 0x89, 0xb0, 0x27, 0xa8, 0x14, 0xa5,
+	0xd4, 0x5a, 0x6a, 0x3d, 0xbf, 0xf9, 0xe1, 0x39, 0x4c, 0x1d, 0xed, 0x89, 0x63, 0x04, 0x2a, 0xc3,
+	0x3c, 0x3d, 0xf6, 0x79, 0x20, 0xbb, 0xbc, 0x94, 0x5e, 0x4b, 0xad, 0xe7, 0xf0, 0xe4, 0xbb, 0xf2,
+	0x47, 0x16, 0x16, 0x4f, 0xad, 0x8c, 0xba, 0xb0, 0xe8, 0x72, 0xd2, 0xb7, 0x7b, 0xc4, 0x25, 0x9e,
+	0x43, 0x03, 0x7d, 0xb0, 0xfc, 0x66, 0xf5, 0x9c, 0x05, 0x9b, 0x9c, 0xf4, 0x6b, 0xc6, 0xbd, 0x43,
+	0xa5, 0x64, 0xde, 0x40, 0xe0, 0x05, 0x77, 0x66, 0x16, 0x3d, 0x85, 0x25, 0x87, 0x7b, 0x1e, 0x75,
+	0xb4, 0x9c, 0x3e, 0xe7, 0xae, 0x09, 0xc9, 0xc6, 0x39, 0xbc, 0xdb, 0x13, 0x44, 0x9b, 0x73, 0x77,
+	0xc2, 0x5c, 0x70, 0x4e, 0xcd, 0xa3, 0x6f, 0x60, 0x99, 0x87, 0xd2, 0x65, 0x34, 0xb0, 0xfb, 0x54,
+	0x46, 0x86, 0x52, 0x4a, 0xb3, 0x7f, 0x7a, 0x0e, 0x7b, 0x2b, 0xc2, 0xec, 0xc4, 0x10, 0x5c, 0xe4,
+	0xaf, 0xcc, 0xa0, 0x7b, 0x90, 0x92, 0xae, 0x28, 0xa5, 0x35, 0xd7, 0xc7, 0xe7, 0x89, 0xd7, 0xec,
+	0x4c, 0xb6, 0xa7, 0x20, 0xe8, 0x19, 0xbc, 0xa7, 0x22, 0x6c, 0xbb, 0x74, 0x4c, 0x55, 0x6e, 0x45,
+	0xb6, 0x52, 0x46, 0x8b, 0x77, 0xff, 0x6d, 0xd3, 0xc0, 0x6a, 0x2b, 0x95, 0x4e, 0x25, 0xc6, 0xb2,
+	0xa2, 0x6d, 0x2a, 0xd6, 0x78, 0xc1, 0xf2, 0x8b, 0x14, 0x2c, 0xbf, 0xe6, 0x88, 0x1e, 0x40, 0x5a,
+	0xb9, 0x1a, 0xf9, 0x6e, 0x9d, 0xb3, 0xa4, 0xc2, 0x76, 0xa8, 0x4b, 0x1d, 0xc9, 0x03, 0xac, 0x41,
+	0xaf, 0x27, 0x41, 0xf2, 0x1d, 0x25, 0x41, 0xea, 0x9d, 0x26, 0x41, 0xfa, 0x7f, 0x4c, 0x82, 0xcc,
+	0xa5, 0x93, 0xa0, 0xf2, 0x77, 0x02, 0xb2, 0xd1, 0x65, 0x54, 0x55, 0xc2, 0x23, 0x23, 0x1a, 0x57,
+	0x09, 0x35, 0x46, 0x75, 0xc8, 0xba, 0xa4, 0x47, 0x5d, 0x51, 0x4a, 0xea, 0xb4, 0xb8, 0x73, 0xe1,
+	0x9d, 0xb6, 0x9a, 0xda, 0xbf, 0xee, 0xc9, 0xe0, 0x04, 0x1b, 0xf0, 0x19, 0xc5, 0x26, 0x75, 0xa5,
+	0x62, 0x53, 0xfe, 0x12, 0xf2, 0x33, 0xeb, 0xa0, 0x22, 0xa4, 0x8e, 0xe8, 0x89, 0xd9, 0xb9, 0x1a,
+	0xa2, 0x15, 0xc8, 0x8c, 0x89, 0x1b, 0x52, 0x9d, 0x15, 0x39, 0x1c, 0x7d, 0xdc, 0x4f, 0xde, 0x4b,
+	0x54, 0x7e, 0xca, 0xc0, 0xca, 0x59, 0x89, 0x80, 0x30, 0x64, 0x05, 0x1b, 0xf9, 0x6e, 0x14, 0x81,
+	0xc2, 0xe6, 0xbd, 0x4b, 0x66, 0x92, 0xd5, 0xd1, 0xe8, 0x66, 0xad, 0x31, 0x87, 0x0d, 0x13, 0x3a,
+	0xd2, 0xe9, 0x24, 0x98, 0x90, 0xd4, 0x93, 0xf6, 0x90, 0x88, 0xa1, 0x49, 0xd3, 0x47, 0x97, 0x25,
+	0xdf, 0x9e, 0xd0, 0x34, 0x88, 0x18, 0xea, 0x45, 0x0a, 0xce, 0xa9, 0xb9, 0xf2, 0x3f, 0x49, 0x28,
+	0xbe, 0xea, 0x86, 0x6e, 0x43, 0x71, 0x28, 0xa5, 0x6f, 0x0f, 0x29, 0xe9, 0xd3, 0xc0, 0x9e, 0x2a,
+	0xac, 0x08, 0x94, 0xa5, 0xa1, 0x0d, 0xfb, 0x4a, 0x6d, 0x0f, 0xf2, 0xda, 0xd7, 0xe1, 0xfc, 0x88,
+	0x51, 0xb3, 0xd3, 0x27, 0x57, 0xdd, 0xa9, 0xd5, 0xe8, 0x76, 0xdb, 0xdb, 0x9a, 0xb2, 0x31, 0x87,
+	0x41, 0xad, 0x10, 0x7d, 0xa1, 0x8f, 0x60, 0x31, 0x14, 0xd4, 0x16, 0x3c, 0x0c, 0x1c, 0x6a, 0x33,
+	0x5f, 0x67, 0xc5, 0x7c, 0x63, 0x0e, 0xe7, 0x43, 0x41, 0x3b, 0x7a, 0x76, 0xd7, 0x47, 0xb7, 0x61,
+	0x79, 0xc4, 0x3c, 0x36, 0x0a, 0x47, 0x76, 0xc0, 0xbc, 0x81, 0x2d, 0xd8, 0x73, 0xaa, 0xaf, 0x4d,
+	0x1a, 0x2f, 0x19, 0x03, 0x66, 0xde, 0xa0, 0xc3, 0x9e, 0xd3, 0xf2, 0x00, 0x60, 0xba, 0xda, 0x99,
+	0x19, 0x8d, 0x20, 0xed, 0x13, 0x39, 0x34, 0x79, 0xa1, 0xc7, 0x68, 0x03, 0x52, 0x52, 0xc6, 0x17,
+	0xfd, 0x86, 0x15, 0xb5, 0x68, 0x2b, 0x6e, 0xd1, 0xd6, 0x8e, 0x69, 0xd1, 0xb5, 0xf4, 0x0f, 0x7f,
+	0xde, 0x4c, 0x60, 0xe5, 0x5b, 0x03, 0x98, 0x57, 0x6a, 0xda, 0x47, 0xf4, 0xa4, 0xd2, 0x80, 0xf9,
+	0x58, 0x7a, 0xb4, 0x04, 0x79, 0xdc, 0x3a, 0xd8, 0xdf, 0xb1, 0x71, 0xab, 0xb6, 0xbb, 0x5f, 0x9c,
+	0x43, 0x05, 0x80, 0x66, 0x7d, 0xab, 0xd3, 0xb5, 0xb7, 0x5b, 0xfb, 0xfb, 0xc5, 0x04, 0x02, 0xc8,
+	0xe2, 0xad, 0xfd, 0x9d, 0xd6, 0x5e, 0x31, 0xa9, 0x9c, 0xdb, 0x5b, 0x9d, 0x4e, 0xb7, 0x81, 0x5b,
+	0x07, 0x8f, 0x1b, 0xc5, 0x54, 0x2d, 0x0f, 0x39, 0xb7, 0x67, 0xae, 0x48, 0xe5, 0x45, 0x16, 0xae,
+	0x9f, 0x5d, 0x59, 0x50, 0x0b, 0x52, 0xd2, 0xf1, 0x4d, 0xdd, 0x7c, 0x78, 0xe9, 0xca, 0x64, 0x75,
+	0xb7, 0xdb, 0x33, 0x65, 0xc0, 0xf1, 0x11, 0x86, 0xb4, 0xd2, 0xc5, 0x48, 0xfe, 0xd5, 0xe5, 0x19,
+	0x55, 0xd4, 0x27, 0x94, 0x9a, 0xab, 0xfc, 0x6f, 0x12, 0xf2, 0x33, 0x0b, 0xa1, 0x5b, 0xb0, 0x34,
+	0x22, 0xc7, 0xf6, 0xb4, 0x28, 0x0a, 0x7d, 0x80, 0x0c, 0x2e, 0x8c, 0xc8, 0xf1, 0x94, 0x56, 0xa0,
+	0xda, 0xa4, 0x06, 0xdb, 0x92, 0x8d, 0x28, 0x0f, 0xa5, 0xd9, 0xd7, 0x9b, 0xa5, 0x99, 0xd4, 0xda,
+	0x6e, 0x04, 0x40, 0x1c, 0x16, 0xa5, 0xe3, 0xdb, 0x47, 0x94, 0xfa, 0xc4, 0x65, 0x63, 0x6a, 0xc4,
+	0xfd, 0xfa, 0x4a, 0xb1, 0xb2, 0xba, 0x8e, 0xff, 0x24, 0x66, 0xc4, 0x0b, 0x72, 0xe6, 0xab, 0xfc,
+	0x7d, 0x02, 0x16, 0x66, 0xcd, 0xe8, 0x3a, 0x64, 0xfd, 0x80, 0xf7, 0x68, 0x74, 0xca, 0x45, 0x6c,
+	0xbe, 0xd0, 0x1d, 0x48, 0xab, 0x53, 0x5d, 0x7c, 0x24, 0xed, 0x86, 0xbe, 0x80, 0x79, 0xe6, 0x49,
+	0x1a, 0x8c, 0xc9, 0xc5, 0x09, 0x8a, 0x27, 0xae, 0xe5, 0xdf, 0x13, 0xb0, 0x30, 0xab, 0x09, 0x7a,
+	0x00, 0x65, 0xa5, 0xca, 0x86, 0xad, 0x34, 0xf0, 0xa9, 0xd7, 0x57, 0x57, 0x29, 0xa0, 0xdf, 0x86,
+	0x54, 0xc8, 0x58, 0x88, 0xf7, 0xb5, 0xc7, 0x1e, 0x39, 0x6e, 0x47, 0x76, 0x6c, 0xcc, 0xe8, 0x33,
+	0x40, 0xca, 0xb4, 0xa9, 0xc1, 0x13, 0x50, 0x52, 0x83, 0x74, 0x79, 0xd9, 0xdc, 0x23, 0xc7, 0x13,
+	0xef, 0x87, 0xf0, 0xc1, 0xac, 0x9f, 0xed, 0xd3, 0x60, 0x46, 0x75, 0x7d, 0x8a, 0x0c, 0x2e, 0x8d,
+	0xa6, 0x88, 0x36, 0x0d, 0xa6, 0xc1, 0x47, 0x37, 0x21, 0x1f, 0xc1, 0x65, 0xc0, 0x68, 0xf4, 0xb2,
+	0xc9, 0x60, 0xd0, 0xee, 0x7a, 0xa6, 0xf2, 0x63, 0x12, 0x8a, 0xaf, 0x36, 0x45, 0x74, 0x07, 0x90,
+	0x2a, 0x87, 0xd4, 0x09, 0x25, 0x1b, 0x53, 0x9b, 0x06, 0x01, 0x0f, 0xe2, 0x73, 0x2d, 0xcf, 0x58,
+	0xea, 0xda, 0x70, 0x2a, 0xac, 0xc9, 0xb7, 0x0e, 0x2b, 0x7a, 0x0c, 0xa8, 0x47, 0x04, 0xb5, 0xe9,
+	0x33, 0xf3, 0x42, 0xd0, 0x52, 0x5e, 0xa8, 0x4b, 0x51, 0x81, 0xea, 0x06, 0xa3, 0x52, 0x14, 0x7d,
+	0x0e, 0x2b, 0xea, 0x90, 0x13, 0x1e, 0x9f, 0x06, 0x0e, 0xf5, 0xa4, 0x39, 0x2d, 0x1a, 0x91, 0xe3,
+	0xd8, 0xbd, 0x1d, 0x59, 0x94, 0x06, 0x23, 0xe6, 0xa9, 0x3a, 0xee, 0xca, 0xe1, 0xc4, 0x3f, 0x13,
+	0x69, 0x30, 0x62, 0x5e, 0x43, 0x1b, 0x8c, 0x77, 0xe5, 0x17, 0x75, 0xf9, 0xa6, 0xcd, 0x1e, 0xd5,
+	0x20, 0x3d, 0xe2, 0xfd, 0xb8, 0xb5, 0x59, 0x6f, 0xf7, 0x44, 0x50, 0x63, 0x85, 0xc2, 0x1a, 0xab,
+	0x43, 0xec, 0x32, 0xd5, 0xc8, 0x1c, 0x1a, 0x48, 0x76, 0xc8, 0x1c, 0x22, 0xe3, 0x06, 0xbb, 0x1c,
+	0x59, 0xb6, 0xa7, 0x06, 0xa5, 0xa3, 0x1f, 0xb0, 0x31, 0x91, 0x54, 0x55, 0x49, 0x1d, 0xa4, 0x1c,
+	0x06, 0x33, 0xf5, 0x84, 0x9e, 0xa8, 0x82, 0xe0, 0x90, 0x59, 0xae, 0x48, 0xec, 0x1c, 0x2e, 0x38,
+	0x64, 0x86, 0x48, 0xa8, 0x0e, 0x20, 0xc2, 0x9e, 0x8a, 0x87, 0x4d, 0x5c, 0xa9, 0x7b, 0x58, 0xf4,
+	0x4e, 0xcd, 0xe1, 0x25, 0x63, 0xd8, 0x72, 0xa5, 0x6a, 0x61, 0x42, 0x3d, 0x05, 0x84, 0xc7, 0x4a,
+	0xd9, 0xe8, 0x29, 0x20, 0x3c, 0x56, 0x79, 0x04, 0xd7, 0xcc, 0x39, 0x50, 0x1e, 0xae, 0xed, 0xec,
+	0x76, 0xb6, 0x6a, 0xcd, 0x7a, 0x71, 0x4e, 0x55, 0xe2, 0xce, 0xee, 0x5e, 0xbb, 0x59, 0x8f, 0xaa,
+	0xf2, 0xde, 0x41, 0xf7, 0x60, 0xab, 0x59, 0x4c, 0xa2, 0x22, 0x2c, 0xec, 0x76, 0xba, 0xbb, 0x2d,
+	0xdb, 0xcc, 0xa4, 0x6a, 0xd6, 0xcf, 0x2f, 0x57, 0x13, 0xbf, 0xbd, 0x5c, 0x4d, 0xfc, 0xf5, 0x72,
+	0x35, 0xf1, 0x74, 0x2d, 0x8a, 0x1d, 0xe3, 0x55, 0xe2, 0xb3, 0xea, 0x19, 0xff, 0x6b, 0xbd, 0xac,
+	0xce, 0x80, 0xbb, 0xff, 0x05, 0x00, 0x00, 0xff, 0xff, 0xb6, 0x78, 0x29, 0xe1, 0x34, 0x0e, 0x00,
+	0x00,
 }
diff --git a/networking/v1alpha3/destination_rule.proto b/networking/v1alpha3/destination_rule.proto
index 6d54f7a7cc..d8cea55827 100644
--- a/networking/v1alpha3/destination_rule.proto
+++ b/networking/v1alpha3/destination_rule.proto
@@ -15,7 +15,6 @@ syntax = "proto3";
 
 import "google/protobuf/duration.proto";
 import "networking/v1alpha3/virtual_service.proto";
-import "networking/v1alpha3/sidecar.proto";
 import "gogoproto/gogo.proto";
 
 package istio.networking.v1alpha3;
@@ -119,11 +118,11 @@ message DestinationRule {
   // service. Traffic policies can be overridden at subset level.
   repeated Subset subsets = 3;
 
-  // The visibility setting associated with this DestinationRule. Set to
-  // PRIVATE if this destination rule should not be exported, i.e. restrict
-  // the applicability of this destination rule to only workloads in the same
-  // namespace as the destination rule.
-  ConfigScope config_scope = 4;
+  // The resolution of a DestinationRule to apply to a service occurs in the
+  // context of a hierarchy of namespaces. This rule control whether those
+  // namespaces are allowed to select this rule.
+  //
+  repeated string exportTo = 4;
 }
 
 // Traffic policies to apply for a specific destination, across all
diff --git a/networking/v1alpha3/istio.networking.v1alpha3.pb.html b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
index 3076ae350c..140dadbfef 100644
--- a/networking/v1alpha3/istio.networking.v1alpha3.pb.html
+++ b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
@@ -6,7 +6,7 @@
 generator: protoc-gen-docs
 aliases:
   - /docs/reference/config/istio.routing.v1alpha1/
-number_of_entries: 61
+number_of_entries: 60
 ---
 <p>Configuration affecting traffic routing. Here are a few terms useful to define
 in the context of traffic routing.</p>
@@ -73,40 +73,6 @@ <h2 id="CaptureMode">CaptureMode</h2>
 to ensure that the listener port is not in use by other processes on
 the host.</p>
 
-</td>
-</tr>
-</tbody>
-</table>
-</section>
-<h2 id="ConfigScope">ConfigScope</h2>
-<section>
-<p>ConfigScope defines the visibility of an Istio configuration artifact in
-a namespace when the namespace is imported.  By default all
-configuration artifacts are public. Configurations with private scope
-will not be imported when the namespace containing the configuration is
-imported in a Sidecar.</p>
-
-<table class="enum-values">
-<thead>
-<tr>
-<th>Name</th>
-<th>Description</th>
-</tr>
-</thead>
-<tbody>
-<tr id="ConfigScope-PUBLIC">
-<td><code>PUBLIC</code></td>
-<td>
-<p>Config with this scope are visible to all workloads in the mesh</p>
-
-</td>
-</tr>
-<tr id="ConfigScope-PRIVATE">
-<td><code>PRIVATE</code></td>
-<td>
-<p>Configs with this scope are visible to only workloads in the same
-namespace as the configuration resource.</p>
-
 </td>
 </tr>
 </tbody>
@@ -705,14 +671,13 @@ <h2 id="DestinationRule">DestinationRule</h2>
 
 </td>
 </tr>
-<tr id="DestinationRule-config_scope">
-<td><code>configScope</code></td>
-<td><code><a href="#ConfigScope">ConfigScope</a></code></td>
+<tr id="DestinationRule-exportTo">
+<td><code>exportTo</code></td>
+<td><code>string[]</code></td>
 <td>
-<p>The visibility setting associated with this DestinationRule. Set to
-PRIVATE if this destination rule should not be exported, i.e. restrict
-the applicability of this destination rule to only workloads in the same
-namespace as the destination rule.</p>
+<p>The resolution of a DestinationRule to apply to a service occurs in the
+context of a hierarchy of namespaces. This rule control whether those
+namespaces are allowed to select this rule.</p>
 
 </td>
 </tr>
@@ -3266,15 +3231,23 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 </code></pre>
 
 <p>The following example demonstrates the use of a dedicated egress gateway
-through which all external service traffic is forwarded.</p>
+through which all external service traffic is forwarded.
+The &lsquo;exportTo&rsquo; field allows for control over the visibility of a service
+declaration to other namespaces in the mesh. By default a service is exported
+to all namespaces. The following example restricts the visibility to the
+current namespace, represented by &ldquo;.&rdquo;, so that it cannot be used by other
+namespaces.</p>
 
 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3
 kind: ServiceEntry
 metadata:
   name: external-svc-httpbin
+  namespace : egress
 spec:
   hosts:
   - httpbin.com
+  exportTo:
+  - .
   location: MESH_EXTERNAL
   ports:
   - number: 80
@@ -3289,6 +3262,7 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 kind: Gateway
 metadata:
  name: istio-egressgateway
+ namespace: egress
 spec:
  selector:
    istio: egressgateway
@@ -3303,15 +3277,21 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 
 <p>And the associated VirtualService to route from the sidecar to the
 gateway service (istio-egressgateway.istio-system.svc.cluster.local), as
-well as route from the gateway to the external service.</p>
+well as route from the gateway to the external service. Note that the
+virtual service is exported to all namespaces enabling them to route traffic
+through the gateway to the external service. Forcing traffic to go through
+a managed middle proxy like this is a common practice.</p>
 
 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
   name: gateway-routing
+  namespace: egress
 spec:
   hosts:
   - httpbin.com
+  exportTo:
+  - *
   gateways:
   - mesh
   - istio-egressgateway
@@ -3492,15 +3472,26 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 
 </td>
 </tr>
-<tr id="ServiceEntry-config_scope">
-<td><code>configScope</code></td>
-<td><code><a href="#ConfigScope">ConfigScope</a></code></td>
+<tr id="ServiceEntry-export_to">
+<td><code>exportTo</code></td>
+<td><code>string[]</code></td>
 <td>
-<p>The visibility setting associated with this service entry. Set to
-PRIVATE if this service should not be visible outside the namespace
-where the service entry was added. The default scope is public,
-i.e. the service added by the service entry will be visible to
-workloads in the entire mesh.</p>
+<p>A list of namespaces to which this service is exported. Exporting a service
+allows it to used by sidecars, gateways and virtual services defined in
+other namespaces. This feature provides a mechanism for service owners
+and mesh administrators to control the visibility of services across
+namespace boundaries.</p>
+
+<p>If no namespaces are specified then the service is exported to all
+namespaces by default.</p>
+
+<p>The value &ldquo;.&rdquo; is reserved and defines an export to the same namespace that
+the service is declared in, similarly the value &ldquo;*&rdquo; is reserved and
+defines an export to all namespaces.</p>
+
+<p>For a Kubernetes Service the equivalent effect can be achieved by setting
+the annotation &ldquo;networking.istio.io/exportTo&rdquo; to a comma-separated list
+of namespace names.</p>
 
 </td>
 </tr>
@@ -4569,14 +4560,22 @@ <h2 id="VirtualService">VirtualService</h2>
 
 </td>
 </tr>
-<tr id="VirtualService-config_scope">
-<td><code>configScope</code></td>
-<td><code><a href="#ConfigScope">ConfigScope</a></code></td>
+<tr id="VirtualService-export_to">
+<td><code>exportTo</code></td>
+<td><code>string[]</code></td>
 <td>
-<p>The visibility setting associated with this VirtualService. Set to
-PRIVATE if this virtual service should not be exported, i.e. restrict
-the applicability of this virtual service to only workloads in the same
-namespace as the virtual service.</p>
+<p>A list of namespaces to which this virtual service is exported. Exporting a
+virtual service allows it to used by sidecars and gateways defined in
+other namespaces. This feature provides a mechanism for service owners
+and mesh administrators to control the visibility of virtual services
+across namespace boundaries.</p>
+
+<p>If no namespaces are specified then the virtual service is exported to all
+namespaces by default.</p>
+
+<p>The value &ldquo;.&rdquo; is reserved and defines an export to the same namespace that
+the virtual service is declared in, similarly the value &ldquo;*&rdquo; is reserved and
+defines an export to all namespaces.</p>
 
 </td>
 </tr>
diff --git a/networking/v1alpha3/service_entry.pb.go b/networking/v1alpha3/service_entry.pb.go
index 47f0813a73..810b9c58ac 100644
--- a/networking/v1alpha3/service_entry.pb.go
+++ b/networking/v1alpha3/service_entry.pb.go
@@ -213,15 +213,23 @@ func (ServiceEntry_Resolution) EnumDescriptor() ([]byte, []int) {
 //
 // The following example demonstrates the use of a dedicated egress gateway
 // through which all external service traffic is forwarded.
+// The 'exportTo' field allows for control over the visibility of a service
+// declaration to other namespaces in the mesh. By default a service is exported
+// to all namespaces. The following example restricts the visibility to the
+// current namespace, represented by ".", so that it cannot be used by other
+// namespaces.
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
 // kind: ServiceEntry
 // metadata:
 //   name: external-svc-httpbin
+//   namespace : egress
 // spec:
 //   hosts:
 //   - httpbin.com
+//   exportTo:
+//   - .
 //   location: MESH_EXTERNAL
 //   ports:
 //   - number: 80
@@ -237,6 +245,7 @@ func (ServiceEntry_Resolution) EnumDescriptor() ([]byte, []int) {
 // kind: Gateway
 // metadata:
 //  name: istio-egressgateway
+//  namespace: egress
 // spec:
 //  selector:
 //    istio: egressgateway
@@ -251,16 +260,22 @@ func (ServiceEntry_Resolution) EnumDescriptor() ([]byte, []int) {
 //
 // And the associated VirtualService to route from the sidecar to the
 // gateway service (istio-egressgateway.istio-system.svc.cluster.local), as
-// well as route from the gateway to the external service.
+// well as route from the gateway to the external service. Note that the
+// virtual service is exported to all namespaces enabling them to route traffic
+// through the gateway to the external service. Forcing traffic to go through
+// a managed middle proxy like this is a common practice.
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
 // kind: VirtualService
 // metadata:
 //   name: gateway-routing
+//   namespace: egress
 // spec:
 //   hosts:
 //   - httpbin.com
+//   exportTo:
+//   - *
 //   gateways:
 //   - mesh
 //   - istio-egressgateway
@@ -400,12 +415,23 @@ type ServiceEntry struct {
 	Resolution ServiceEntry_Resolution `protobuf:"varint,5,opt,name=resolution,proto3,enum=istio.networking.v1alpha3.ServiceEntry_Resolution" json:"resolution,omitempty"`
 	// One or more endpoints associated with the service.
 	Endpoints []*ServiceEntry_Endpoint `protobuf:"bytes,6,rep,name=endpoints" json:"endpoints,omitempty"`
-	// The visibility setting associated with this service entry. Set to
-	// PRIVATE if this service should not be visible outside the namespace
-	// where the service entry was added. The default scope is public,
-	// i.e. the service added by the service entry will be visible to
-	// workloads in the entire mesh.
-	ConfigScope ConfigScope `protobuf:"varint,7,opt,name=config_scope,json=configScope,proto3,enum=istio.networking.v1alpha3.ConfigScope" json:"config_scope,omitempty"`
+	// A list of namespaces to which this service is exported. Exporting a service
+	// allows it to used by sidecars, gateways and virtual services defined in
+	// other namespaces. This feature provides a mechanism for service owners
+	// and mesh administrators to control the visibility of services across
+	// namespace boundaries.
+	//
+	// If no namespaces are specified then the service is exported to all
+	// namespaces by default.
+	//
+	// The value "." is reserved and defines an export to the same namespace that
+	// the service is declared in, similarly the value "*" is reserved and
+	// defines an export to all namespaces.
+	//
+	// For a Kubernetes Service the equivalent effect can be achieved by setting
+	// the annotation "networking.istio.io/exportTo" to a comma-separated list
+	// of namespace names.
+	ExportTo []string `protobuf:"bytes,7,rep,name=export_to,json=exportTo" json:"export_to,omitempty"`
 }
 
 func (m *ServiceEntry) Reset()                    { *m = ServiceEntry{} }
@@ -455,11 +481,11 @@ func (m *ServiceEntry) GetEndpoints() []*ServiceEntry_Endpoint {
 	return nil
 }
 
-func (m *ServiceEntry) GetConfigScope() ConfigScope {
+func (m *ServiceEntry) GetExportTo() []string {
 	if m != nil {
-		return m.ConfigScope
+		return m.ExportTo
 	}
-	return ConfigScope_PUBLIC
+	return nil
 }
 
 // Endpoint defines a network address (IP or hostname) associated with
@@ -642,10 +668,20 @@ func (m *ServiceEntry) MarshalTo(dAtA []byte) (int, error) {
 			i += n
 		}
 	}
-	if m.ConfigScope != 0 {
-		dAtA[i] = 0x38
-		i++
-		i = encodeVarintServiceEntry(dAtA, i, uint64(m.ConfigScope))
+	if len(m.ExportTo) > 0 {
+		for _, s := range m.ExportTo {
+			dAtA[i] = 0x3a
+			i++
+			l = len(s)
+			for l >= 1<<7 {
+				dAtA[i] = uint8(uint64(l)&0x7f | 0x80)
+				l >>= 7
+				i++
+			}
+			dAtA[i] = uint8(l)
+			i++
+			i += copy(dAtA[i:], s)
+		}
 	}
 	return i, nil
 }
@@ -766,8 +802,11 @@ func (m *ServiceEntry) Size() (n int) {
 			n += 1 + l + sovServiceEntry(uint64(l))
 		}
 	}
-	if m.ConfigScope != 0 {
-		n += 1 + sovServiceEntry(uint64(m.ConfigScope))
+	if len(m.ExportTo) > 0 {
+		for _, s := range m.ExportTo {
+			l = len(s)
+			n += 1 + l + sovServiceEntry(uint64(l))
+		}
 	}
 	return n
 }
@@ -1010,10 +1049,10 @@ func (m *ServiceEntry) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConfigScope", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExportTo", wireType)
 			}
-			m.ConfigScope = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowServiceEntry
@@ -1023,11 +1062,21 @@ func (m *ServiceEntry) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ConfigScope |= (ConfigScope(b) & 0x7F) << shift
+				stringLen |= (uint64(b) & 0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthServiceEntry
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExportTo = append(m.ExportTo, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipServiceEntry(dAtA[iNdEx:])
@@ -1538,38 +1587,37 @@ var (
 func init() { proto.RegisterFile("networking/v1alpha3/service_entry.proto", fileDescriptorServiceEntry) }
 
 var fileDescriptorServiceEntry = []byte{
-	// 521 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x53, 0xcd, 0x6e, 0xd3, 0x4c,
-	0x14, 0xed, 0xc4, 0x8d, 0x13, 0xdf, 0xb4, 0x9f, 0xf2, 0x8d, 0x10, 0x1a, 0x22, 0x14, 0x4c, 0x16,
-	0x10, 0x09, 0xc9, 0x29, 0xa9, 0x90, 0xca, 0xcf, 0xa6, 0x14, 0x4b, 0x44, 0x0a, 0x06, 0x26, 0x59,
-	0x20, 0x36, 0xd1, 0xd4, 0x19, 0x92, 0x51, 0x2d, 0x8f, 0xe5, 0x99, 0x26, 0xca, 0x5b, 0xf0, 0x18,
-	0x3c, 0x0a, 0x4b, 0x1e, 0x01, 0xe5, 0x49, 0x50, 0xc6, 0x76, 0x9c, 0x45, 0x28, 0xed, 0xce, 0xe7,
-	0xfa, 0x9c, 0x73, 0xcf, 0xcc, 0xbd, 0x03, 0x4f, 0x63, 0xae, 0x97, 0x32, 0xbd, 0x12, 0xf1, 0xac,
-	0xb7, 0x78, 0xce, 0xa2, 0x64, 0xce, 0x4e, 0x7b, 0x8a, 0xa7, 0x0b, 0x11, 0xf2, 0x09, 0x8f, 0x75,
-	0xba, 0xf2, 0x92, 0x54, 0x6a, 0x89, 0x1f, 0x08, 0xa5, 0x85, 0xf4, 0x4a, 0xba, 0x57, 0xd0, 0x5b,
-	0x8f, 0xf7, 0x79, 0xcc, 0x98, 0xe6, 0x4b, 0x96, 0xab, 0xf7, 0x53, 0x94, 0x98, 0xf2, 0x90, 0xa5,
-	0x19, 0xa5, 0xf3, 0xa3, 0x06, 0x47, 0xa3, 0xac, 0xb1, 0xbf, 0xe9, 0x8b, 0xef, 0x41, 0x75, 0x2e,
-	0x95, 0x56, 0x04, 0xb9, 0x56, 0xd7, 0xa1, 0x19, 0xc0, 0x0f, 0xc1, 0x61, 0xd3, 0x69, 0xca, 0x95,
-	0xe2, 0x8a, 0x54, 0xcc, 0x9f, 0xb2, 0x80, 0x5f, 0x40, 0x35, 0x91, 0xa9, 0x56, 0xc4, 0x72, 0xad,
-	0x6e, 0xa3, 0xff, 0xc8, 0xfb, 0x6b, 0x6a, 0xef, 0x93, 0x4c, 0x35, 0xcd, 0xd8, 0x78, 0x08, 0xf5,
-	0x48, 0x86, 0x4c, 0x0b, 0x19, 0x93, 0x43, 0x17, 0x75, 0xff, 0xeb, 0x9f, 0xdc, 0xa0, 0xdc, 0x4d,
-	0xe9, 0x0d, 0x73, 0x1d, 0xdd, 0x3a, 0x60, 0x0a, 0x90, 0x72, 0x25, 0xa3, 0x6b, 0xe3, 0x57, 0x35,
-	0x7e, 0xfd, 0xdb, 0xfa, 0xd1, 0xad, 0x92, 0xee, 0xb8, 0xe0, 0x00, 0x1c, 0x1e, 0x4f, 0x13, 0x29,
-	0x62, 0xad, 0x88, 0x6d, 0x0e, 0x77, 0xeb, 0x88, 0x7e, 0x2e, 0xa4, 0xa5, 0x05, 0x1e, 0xc0, 0x51,
-	0x28, 0xe3, 0x6f, 0x62, 0x36, 0x51, 0xa1, 0x4c, 0x38, 0xa9, 0x99, 0x94, 0x4f, 0x6e, 0xb0, 0xbc,
-	0x30, 0xf4, 0xd1, 0x86, 0x4d, 0x1b, 0x61, 0x09, 0x5a, 0xdf, 0x2d, 0xa8, 0x17, 0x2d, 0x30, 0x81,
-	0x5a, 0x3e, 0x0d, 0x82, 0x5c, 0xd4, 0x75, 0x68, 0x01, 0xf1, 0xe7, 0x62, 0x34, 0x15, 0x93, 0xfe,
-	0xf5, 0x5d, 0xd3, 0x9b, 0x81, 0x29, 0x53, 0x2b, 0xc6, 0x36, 0x06, 0x3b, 0x62, 0x97, 0x3c, 0x2a,
-	0xc6, 0xfd, 0xe6, 0xce, 0x9e, 0x43, 0x23, 0xcf, 0x4c, 0x73, 0xaf, 0xcd, 0x11, 0x72, 0x03, 0xb3,
-	0x0b, 0x0e, 0x2d, 0x20, 0x6e, 0x65, 0x6b, 0x12, 0x09, 0xbd, 0x32, 0x63, 0x75, 0xe8, 0x16, 0xe3,
-	0xfb, 0x60, 0x2f, 0xb9, 0x98, 0xcd, 0x35, 0xb1, 0x5d, 0xd4, 0x3d, 0xa6, 0x39, 0x6a, 0x9d, 0x01,
-	0x94, 0xc1, 0x71, 0x13, 0xac, 0x2b, 0xbe, 0xca, 0xaf, 0x66, 0xf3, 0xb9, 0xd9, 0xf2, 0x05, 0x8b,
-	0xae, 0x39, 0xa9, 0x18, 0x59, 0x06, 0x5e, 0x55, 0xce, 0x50, 0xeb, 0x25, 0x34, 0x76, 0xe2, 0xfd,
-	0x4b, 0xea, 0xec, 0x48, 0x3b, 0x27, 0x50, 0x2f, 0xf6, 0x12, 0xff, 0x0f, 0xc7, 0x1f, 0xfc, 0xd1,
-	0xfb, 0x89, 0xff, 0x65, 0xec, 0xd3, 0xe0, 0x7c, 0xd8, 0x3c, 0xd8, 0x96, 0x06, 0x41, 0x5e, 0x42,
-	0x9d, 0x67, 0x00, 0xe5, 0xe6, 0xe1, 0x3a, 0x1c, 0x06, 0x1f, 0x03, 0xbf, 0x79, 0x80, 0x01, 0xec,
-	0xd1, 0xf8, 0x7c, 0x3c, 0xb8, 0x68, 0x22, 0x5c, 0x03, 0xeb, 0x5d, 0x30, 0x6a, 0x56, 0xde, 0x7a,
-	0x3f, 0xd7, 0x6d, 0xf4, 0x6b, 0xdd, 0x46, 0xbf, 0xd7, 0x6d, 0xf4, 0xd5, 0xcd, 0x2e, 0x5d, 0xc8,
-	0x1e, 0x4b, 0x44, 0x6f, 0xcf, 0x43, 0xbf, 0xb4, 0xcd, 0x0b, 0x3f, 0xfd, 0x13, 0x00, 0x00, 0xff,
-	0xff, 0x52, 0x1f, 0x71, 0x64, 0x6d, 0x04, 0x00, 0x00,
+	// 497 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x93, 0xdf, 0x6e, 0xd3, 0x30,
+	0x14, 0xc6, 0xe7, 0x66, 0x4b, 0x93, 0x33, 0x86, 0x82, 0x85, 0x90, 0x09, 0xa8, 0x84, 0xde, 0x10,
+	0x09, 0x29, 0x1d, 0x9d, 0x90, 0xc6, 0x9f, 0x9b, 0x01, 0x91, 0x98, 0x54, 0x02, 0xb8, 0xb9, 0x40,
+	0xdc, 0x54, 0xd9, 0x6a, 0xb5, 0xd6, 0xa2, 0x38, 0x8a, 0xbd, 0x96, 0xbe, 0x05, 0x8f, 0xc5, 0x25,
+	0x8f, 0x80, 0xfa, 0x18, 0x5c, 0xa1, 0x38, 0x49, 0xd3, 0x8b, 0x01, 0xdb, 0x5d, 0xce, 0x89, 0xbf,
+	0x9f, 0x3e, 0x9f, 0xef, 0x18, 0x9e, 0x64, 0x4c, 0x2d, 0x45, 0x71, 0xc1, 0xb3, 0xd9, 0x60, 0xf1,
+	0x2c, 0x49, 0xf3, 0x79, 0x72, 0x34, 0x90, 0xac, 0x58, 0xf0, 0x73, 0x36, 0x61, 0x99, 0x2a, 0x56,
+	0x41, 0x5e, 0x08, 0x25, 0xf0, 0x7d, 0x2e, 0x15, 0x17, 0x41, 0x7b, 0x3c, 0x68, 0x8e, 0xbb, 0x8f,
+	0xaf, 0x62, 0xcc, 0x12, 0xc5, 0x96, 0x49, 0xad, 0xee, 0xff, 0x36, 0xe1, 0xd6, 0xb8, 0xa2, 0x86,
+	0x25, 0x14, 0xdf, 0x85, 0xbd, 0xb9, 0x90, 0x4a, 0x12, 0xe4, 0x19, 0xbe, 0x4d, 0xab, 0x02, 0x3f,
+	0x04, 0x3b, 0x99, 0x4e, 0x0b, 0x26, 0x25, 0x93, 0xa4, 0xa3, 0xff, 0xb4, 0x0d, 0xfc, 0x1c, 0xf6,
+	0x72, 0x51, 0x28, 0x49, 0x0c, 0xcf, 0xf0, 0xf7, 0x87, 0x8f, 0x82, 0xbf, 0x5a, 0x0a, 0x3e, 0x89,
+	0x42, 0xd1, 0xea, 0x34, 0x1e, 0x81, 0x95, 0x8a, 0xf3, 0x44, 0x71, 0x91, 0x91, 0x5d, 0x0f, 0xf9,
+	0xb7, 0x87, 0x87, 0xff, 0x50, 0x6e, 0xbb, 0x0c, 0x46, 0xb5, 0x8e, 0x6e, 0x08, 0x98, 0x02, 0x14,
+	0x4c, 0x8a, 0xf4, 0x52, 0xf3, 0xf6, 0x34, 0x6f, 0x78, 0x5d, 0x1e, 0xdd, 0x28, 0xe9, 0x16, 0x05,
+	0x47, 0x60, 0xb3, 0x6c, 0x9a, 0x0b, 0x9e, 0x29, 0x49, 0x4c, 0x7d, 0xb9, 0x6b, 0x5b, 0x0c, 0x6b,
+	0x21, 0x6d, 0x11, 0xf8, 0x01, 0xd8, 0xec, 0x5b, 0x79, 0xf9, 0x89, 0x12, 0xa4, 0xab, 0xc7, 0x68,
+	0x55, 0x8d, 0x58, 0xb8, 0xdf, 0x0d, 0xb0, 0x1a, 0x11, 0x26, 0xd0, 0xad, 0xe7, 0x4b, 0x90, 0x87,
+	0x7c, 0x9b, 0x36, 0x25, 0xfe, 0xdc, 0x0c, 0xbb, 0xa3, 0xfd, 0xbc, 0xba, 0xa9, 0x1f, 0x1d, 0x81,
+	0xd4, 0xbd, 0x26, 0x88, 0x18, 0xcc, 0x34, 0x39, 0x63, 0x69, 0x13, 0xe0, 0xeb, 0x1b, 0x33, 0x47,
+	0x5a, 0x5e, 0x41, 0x6b, 0x56, 0x79, 0x85, 0x1a, 0xa0, 0xd3, 0xb5, 0x69, 0x53, 0x62, 0xb7, 0x0a,
+	0x3e, 0xe5, 0x6a, 0xa5, 0x83, 0xb2, 0xe9, 0xa6, 0xc6, 0xf7, 0xc0, 0x5c, 0x32, 0x3e, 0x9b, 0x2b,
+	0x62, 0x7a, 0xc8, 0x3f, 0xa0, 0x75, 0xe5, 0x1e, 0x03, 0xb4, 0xc6, 0xb1, 0x03, 0xc6, 0x05, 0x5b,
+	0xd5, 0xa3, 0x29, 0x3f, 0xcb, 0xbd, 0x5d, 0x24, 0xe9, 0x25, 0x23, 0x1d, 0x2d, 0xab, 0x8a, 0x97,
+	0x9d, 0x63, 0xe4, 0xbe, 0x80, 0xfd, 0x2d, 0x7b, 0xff, 0x93, 0xda, 0x5b, 0xd2, 0xfe, 0x21, 0x58,
+	0xcd, 0xa6, 0xe1, 0x3b, 0x70, 0xf0, 0x21, 0x1c, 0xbf, 0x9f, 0x84, 0x5f, 0xe2, 0x90, 0x46, 0x27,
+	0x23, 0x67, 0x67, 0xd3, 0x3a, 0x8d, 0xea, 0x16, 0xea, 0x3f, 0x05, 0x68, 0x77, 0x09, 0x5b, 0xb0,
+	0x1b, 0x7d, 0x8c, 0x42, 0x67, 0x07, 0x03, 0x98, 0xe3, 0xf8, 0x24, 0x3e, 0x7d, 0xeb, 0x20, 0xdc,
+	0x05, 0xe3, 0x5d, 0x34, 0x76, 0x3a, 0x6f, 0x82, 0x1f, 0xeb, 0x1e, 0xfa, 0xb9, 0xee, 0xa1, 0x5f,
+	0xeb, 0x1e, 0xfa, 0xea, 0x55, 0x43, 0xe7, 0x62, 0x90, 0xe4, 0x7c, 0x70, 0xc5, 0xd3, 0x3d, 0x33,
+	0xf5, 0x9b, 0x3d, 0xfa, 0x13, 0x00, 0x00, 0xff, 0xff, 0xbf, 0xab, 0x5c, 0x44, 0x1c, 0x04, 0x00,
+	0x00,
 }
diff --git a/networking/v1alpha3/service_entry.proto b/networking/v1alpha3/service_entry.proto
index 7c200a59aa..ccd7724c51 100644
--- a/networking/v1alpha3/service_entry.proto
+++ b/networking/v1alpha3/service_entry.proto
@@ -15,7 +15,6 @@
 syntax = "proto3";
 
 import "networking/v1alpha3/gateway.proto";
-import "networking/v1alpha3/sidecar.proto";
 
 package istio.networking.v1alpha3;
 
@@ -135,15 +134,23 @@ option go_package = "istio.io/api/networking/v1alpha3";
 //
 // The following example demonstrates the use of a dedicated egress gateway
 // through which all external service traffic is forwarded.
+// The 'exportTo' field allows for control over the visibility of a service
+// declaration to other namespaces in the mesh. By default a service is exported
+// to all namespaces. The following example restricts the visibility to the
+// current namespace, represented by ".", so that it cannot be used by other
+// namespaces.
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
 // kind: ServiceEntry
 // metadata:
 //   name: external-svc-httpbin
+//   namespace : egress
 // spec:
 //   hosts:
 //   - httpbin.com
+//   exportTo:
+//   - .
 //   location: MESH_EXTERNAL
 //   ports:
 //   - number: 80
@@ -159,6 +166,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // kind: Gateway
 // metadata:
 //  name: istio-egressgateway
+//  namespace: egress
 // spec:
 //  selector:
 //    istio: egressgateway
@@ -173,16 +181,22 @@ option go_package = "istio.io/api/networking/v1alpha3";
 //
 // And the associated VirtualService to route from the sidecar to the
 // gateway service (istio-egressgateway.istio-system.svc.cluster.local), as
-// well as route from the gateway to the external service.
+// well as route from the gateway to the external service. Note that the
+// virtual service is exported to all namespaces enabling them to route traffic
+// through the gateway to the external service. Forcing traffic to go through
+// a managed middle proxy like this is a common practice.
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
 // kind: VirtualService
 // metadata:
 //   name: gateway-routing
+//   namespace: egress
 // spec:
 //   hosts:
 //   - httpbin.com
+//   exportTo:
+//   - *
 //   gateways:
 //   - mesh
 //   - istio-egressgateway
@@ -429,10 +443,21 @@ message ServiceEntry {
   // One or more endpoints associated with the service.
   repeated Endpoint endpoints = 6;
 
-  // The visibility setting associated with this service entry. Set to
-  // PRIVATE if this service should not be visible outside the namespace
-  // where the service entry was added. The default scope is public,
-  // i.e. the service added by the service entry will be visible to
-  // workloads in the entire mesh.
-  ConfigScope config_scope = 7;
+  // A list of namespaces to which this service is exported. Exporting a service
+  // allows it to used by sidecars, gateways and virtual services defined in
+  // other namespaces. This feature provides a mechanism for service owners
+  // and mesh administrators to control the visibility of services across
+  // namespace boundaries.
+  //
+  // If no namespaces are specified then the service is exported to all
+  // namespaces by default.
+  //
+  // The value "." is reserved and defines an export to the same namespace that
+  // the service is declared in, similarly the value "*" is reserved and
+  // defines an export to all namespaces.
+  //
+  // For a Kubernetes Service the equivalent effect can be achieved by setting
+  // the annotation "networking.istio.io/exportTo" to a comma-separated list
+  // of namespace names.
+  repeated string export_to = 7;
 }
diff --git a/networking/v1alpha3/sidecar.pb.go b/networking/v1alpha3/sidecar.pb.go
index 0c2afe181a..261089983c 100644
--- a/networking/v1alpha3/sidecar.pb.go
+++ b/networking/v1alpha3/sidecar.pb.go
@@ -14,35 +14,6 @@ var _ = proto.Marshal
 var _ = fmt.Errorf
 var _ = math.Inf
 
-// ConfigScope defines the visibility of an Istio configuration artifact in
-// a namespace when the namespace is imported.  By default all
-// configuration artifacts are public. Configurations with private scope
-// will not be imported when the namespace containing the configuration is
-// imported in a Sidecar.
-type ConfigScope int32
-
-const (
-	// Config with this scope are visible to all workloads in the mesh
-	ConfigScope_PUBLIC ConfigScope = 0
-	// Configs with this scope are visible to only workloads in the same
-	// namespace as the configuration resource.
-	ConfigScope_PRIVATE ConfigScope = 1
-)
-
-var ConfigScope_name = map[int32]string{
-	0: "PUBLIC",
-	1: "PRIVATE",
-}
-var ConfigScope_value = map[string]int32{
-	"PUBLIC":  0,
-	"PRIVATE": 1,
-}
-
-func (x ConfigScope) String() string {
-	return proto.EnumName(ConfigScope_name, int32(x))
-}
-func (ConfigScope) EnumDescriptor() ([]byte, []int) { return fileDescriptorSidecar, []int{0} }
-
 // CaptureMode describes how traffic to a listener is expected to be
 // captured. Applicable only when the listener is bound to an IP.
 type CaptureMode int32
@@ -74,7 +45,7 @@ var CaptureMode_value = map[string]int32{
 func (x CaptureMode) String() string {
 	return proto.EnumName(CaptureMode_name, int32(x))
 }
-func (CaptureMode) EnumDescriptor() ([]byte, []int) { return fileDescriptorSidecar, []int{1} }
+func (CaptureMode) EnumDescriptor() ([]byte, []int) { return fileDescriptorSidecar, []int{0} }
 
 // `Sidecar` describes the configuration of the sidecar proxy that mediates
 // inbound and outbound communication to the workload it is attached to. By
@@ -367,7 +338,6 @@ func init() {
 	proto.RegisterType((*IstioIngressListener)(nil), "istio.networking.v1alpha3.IstioIngressListener")
 	proto.RegisterType((*IstioEgressListener)(nil), "istio.networking.v1alpha3.IstioEgressListener")
 	proto.RegisterType((*WorkloadSelector)(nil), "istio.networking.v1alpha3.WorkloadSelector")
-	proto.RegisterEnum("istio.networking.v1alpha3.ConfigScope", ConfigScope_name, ConfigScope_value)
 	proto.RegisterEnum("istio.networking.v1alpha3.CaptureMode", CaptureMode_name, CaptureMode_value)
 }
 func (m *Sidecar) Marshal() (dAtA []byte, err error) {
@@ -1399,36 +1369,35 @@ var (
 func init() { proto.RegisterFile("networking/v1alpha3/sidecar.proto", fileDescriptorSidecar) }
 
 var fileDescriptorSidecar = []byte{
-	// 496 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x93, 0x3f, 0x6f, 0xd3, 0x40,
-	0x18, 0xc6, 0x7b, 0xb1, 0x49, 0x9a, 0xd7, 0x15, 0x98, 0xa3, 0x83, 0xe9, 0x10, 0x4c, 0x86, 0xca,
-	0x14, 0xc9, 0x16, 0xc9, 0xc0, 0x9f, 0x2d, 0x09, 0xae, 0x64, 0xc9, 0xb4, 0x91, 0x93, 0x02, 0x62,
-	0x89, 0x2e, 0xf6, 0x35, 0x3d, 0xd5, 0xf8, 0xac, 0xf3, 0xa5, 0x51, 0xbe, 0x0c, 0x5f, 0x85, 0x95,
-	0x91, 0x85, 0x1d, 0xe5, 0x43, 0x30, 0x23, 0xff, 0xa9, 0x5a, 0xa2, 0x10, 0xc4, 0xd6, 0xed, 0xde,
-	0xf7, 0x9e, 0xe7, 0xf7, 0xfa, 0xf1, 0xdd, 0xc1, 0xd3, 0x84, 0xca, 0x05, 0x17, 0x97, 0x2c, 0x99,
-	0x39, 0x57, 0x2f, 0x48, 0x9c, 0x5e, 0x90, 0xae, 0x93, 0xb1, 0x88, 0x86, 0x44, 0xd8, 0xa9, 0xe0,
-	0x92, 0xe3, 0xc7, 0x2c, 0x93, 0x8c, 0xdb, 0x37, 0x42, 0xfb, 0x5a, 0x78, 0xb0, 0xd1, 0x3d, 0x23,
-	0x92, 0x2e, 0xc8, 0xb2, 0x74, 0xb7, 0x7f, 0x21, 0x68, 0x8c, 0x4a, 0x1e, 0xfe, 0x08, 0x0f, 0x73,
-	0x75, 0xcc, 0x49, 0x34, 0xc9, 0x68, 0x4c, 0x43, 0xc9, 0x85, 0x81, 0x4c, 0x64, 0x69, 0x9d, 0xe7,
-	0xf6, 0x5f, 0xa7, 0xd8, 0x1f, 0x2a, 0xcf, 0xa8, 0xb2, 0x04, 0xfa, 0x62, 0xad, 0x83, 0x3d, 0x68,
-	0xb0, 0x64, 0x26, 0x68, 0x96, 0x19, 0x35, 0x53, 0xb1, 0xb4, 0x8e, 0xb3, 0x85, 0xe7, 0xe5, 0x3b,
-	0x5e, 0x29, 0xf7, 0x59, 0x26, 0x69, 0x42, 0x45, 0x70, 0xed, 0xc7, 0xc7, 0x50, 0xa7, 0x25, 0x49,
-	0x29, 0x48, 0xf6, 0xbf, 0x48, 0xee, 0x9f, 0xa0, 0xca, 0xdd, 0xfe, 0x81, 0x60, 0x7f, 0xd3, 0x24,
-	0xdc, 0x05, 0x35, 0xe5, 0x42, 0x56, 0xc1, 0x9f, 0x6c, 0xc1, 0x0f, 0xb9, 0x90, 0x41, 0x21, 0xc6,
-	0x18, 0xd4, 0x29, 0x4b, 0x22, 0xa3, 0x66, 0x22, 0xab, 0x19, 0x14, 0x6b, 0xec, 0xc1, 0x5e, 0x48,
-	0x52, 0x39, 0x17, 0x74, 0xf2, 0x99, 0x47, 0xd4, 0x50, 0x4c, 0x64, 0xdd, 0xef, 0x1c, 0x6e, 0x01,
-	0x0e, 0x4a, 0xf9, 0x3b, 0x1e, 0xd1, 0x40, 0x0b, 0x6f, 0x0a, 0xfc, 0x0c, 0xf4, 0x88, 0x9e, 0x93,
-	0x79, 0x2c, 0x27, 0x34, 0x89, 0x52, 0xce, 0x12, 0x69, 0xa8, 0xc5, 0xa8, 0x07, 0x55, 0xdf, 0xad,
-	0xda, 0xed, 0xaf, 0x08, 0x1e, 0x6d, 0xc8, 0x7d, 0x27, 0x63, 0xed, 0xc3, 0xbd, 0x0b, 0x9e, 0xc9,
-	0xcc, 0x50, 0x4d, 0xc5, 0x6a, 0x06, 0x65, 0xd1, 0xfe, 0x82, 0x40, 0x5f, 0xbf, 0x53, 0xf8, 0x14,
-	0xea, 0x31, 0x99, 0xd2, 0x38, 0x33, 0x50, 0x71, 0xec, 0x2f, 0xff, 0xe3, 0x42, 0xda, 0x7e, 0xe1,
-	0x74, 0x13, 0x29, 0x96, 0x41, 0x85, 0x39, 0x78, 0x0d, 0xda, 0xad, 0x36, 0xd6, 0x41, 0xb9, 0xa4,
-	0xcb, 0xe2, 0xef, 0x34, 0x83, 0x7c, 0x99, 0x7f, 0xdc, 0x15, 0x89, 0xe7, 0xb4, 0x0a, 0x5f, 0x16,
-	0x6f, 0x6a, 0xaf, 0xd0, 0xd1, 0x21, 0x68, 0x03, 0x9e, 0x9c, 0xb3, 0xd9, 0x28, 0xe4, 0x29, 0xc5,
-	0x00, 0xf5, 0xe1, 0x59, 0xdf, 0xf7, 0x06, 0xfa, 0x0e, 0xd6, 0xa0, 0x31, 0x0c, 0xbc, 0xf7, 0xbd,
-	0xb1, 0xab, 0xa3, 0xa3, 0x0e, 0x68, 0xb7, 0xa2, 0xe7, 0x7b, 0x6f, 0xdd, 0xe3, 0xde, 0x99, 0x3f,
-	0xd6, 0x77, 0xf0, 0x1e, 0xec, 0x7a, 0xc3, 0x71, 0xaf, 0xef, 0xbb, 0x23, 0x1d, 0xe1, 0x5d, 0x50,
-	0x4f, 0x4e, 0x4f, 0x5c, 0xbd, 0xd6, 0xb7, 0xbf, 0xad, 0x5a, 0xe8, 0xfb, 0xaa, 0x85, 0x7e, 0xae,
-	0x5a, 0xe8, 0x93, 0x59, 0x86, 0x64, 0xdc, 0x21, 0x29, 0x73, 0x36, 0xbc, 0xe6, 0x69, 0xbd, 0x78,
-	0xc6, 0xdd, 0xdf, 0x01, 0x00, 0x00, 0xff, 0xff, 0x62, 0xef, 0x1c, 0x27, 0x29, 0x04, 0x00, 0x00,
+	// 465 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x93, 0x4f, 0x6f, 0xd3, 0x30,
+	0x18, 0xc6, 0x71, 0x13, 0xda, 0xf5, 0xcd, 0x04, 0xc1, 0xec, 0x10, 0x76, 0x28, 0xa1, 0x07, 0x14,
+	0x40, 0x4a, 0x44, 0x7b, 0xe0, 0xcf, 0x6d, 0x83, 0x4c, 0x8a, 0x54, 0xb6, 0x29, 0x1d, 0x02, 0x71,
+	0xa9, 0xdc, 0xe6, 0xa5, 0xb3, 0x16, 0xe2, 0xc8, 0x76, 0x57, 0xf5, 0xcb, 0xf0, 0x55, 0xb8, 0x72,
+	0xe4, 0xc2, 0x1d, 0xf5, 0x43, 0x70, 0x46, 0x4d, 0x3c, 0x6d, 0x4c, 0xa5, 0x88, 0x1b, 0x37, 0xbf,
+	0x6f, 0x9e, 0xe7, 0xf7, 0xfa, 0x89, 0x6d, 0x78, 0x50, 0xa0, 0x9e, 0x0b, 0x79, 0xc6, 0x8b, 0x69,
+	0x74, 0xfe, 0x94, 0xe5, 0xe5, 0x29, 0xeb, 0x47, 0x8a, 0x67, 0x38, 0x61, 0x32, 0x2c, 0xa5, 0xd0,
+	0x82, 0xde, 0xe3, 0x4a, 0x73, 0x11, 0x5e, 0x0a, 0xc3, 0x0b, 0xe1, 0xee, 0x5a, 0xf7, 0x94, 0x69,
+	0x9c, 0xb3, 0x45, 0xed, 0xee, 0xfe, 0x24, 0xd0, 0x1a, 0xd6, 0x3c, 0xfa, 0x1e, 0xee, 0xac, 0xd4,
+	0xb9, 0x60, 0xd9, 0x48, 0x61, 0x8e, 0x13, 0x2d, 0xa4, 0x47, 0x7c, 0x12, 0x38, 0xbd, 0x27, 0xe1,
+	0x1f, 0xa7, 0x84, 0xef, 0x8c, 0x67, 0x68, 0x2c, 0xa9, 0x3b, 0xbf, 0xd6, 0xa1, 0x09, 0xb4, 0x78,
+	0x31, 0x95, 0xa8, 0x94, 0xd7, 0xf0, 0xad, 0xc0, 0xe9, 0x45, 0x1b, 0x78, 0xc9, 0xea, 0x4b, 0x52,
+	0xcb, 0x07, 0x5c, 0x69, 0x2c, 0x50, 0xa6, 0x17, 0x7e, 0x7a, 0x00, 0x4d, 0xac, 0x49, 0x56, 0x45,
+	0x0a, 0xff, 0x46, 0x8a, 0x7f, 0x07, 0x19, 0x77, 0xf7, 0x3b, 0x81, 0x9d, 0x75, 0x93, 0x68, 0x1f,
+	0xec, 0x52, 0x48, 0x6d, 0x82, 0xdf, 0xdf, 0x80, 0x3f, 0x16, 0x52, 0xa7, 0x95, 0x98, 0x52, 0xb0,
+	0xc7, 0xbc, 0xc8, 0xbc, 0x86, 0x4f, 0x82, 0x76, 0x5a, 0xad, 0x69, 0x02, 0xdb, 0x13, 0x56, 0xea,
+	0x99, 0xc4, 0xd1, 0x27, 0x91, 0xa1, 0x67, 0xf9, 0x24, 0xb8, 0xd5, 0x7b, 0xb8, 0x01, 0xf8, 0xaa,
+	0x96, 0xbf, 0x11, 0x19, 0xa6, 0xce, 0xe4, 0xb2, 0xa0, 0x8f, 0xc0, 0xcd, 0xf0, 0x23, 0x9b, 0xe5,
+	0x7a, 0x84, 0x45, 0x56, 0x0a, 0x5e, 0x68, 0xcf, 0xae, 0x46, 0xdd, 0x36, 0xfd, 0xd8, 0xb4, 0xbb,
+	0x5f, 0x08, 0xdc, 0x5d, 0x93, 0xfb, 0xbf, 0x8c, 0xb5, 0x03, 0x37, 0x4f, 0x85, 0xd2, 0xca, 0xb3,
+	0x7d, 0x2b, 0x68, 0xa7, 0x75, 0xd1, 0xfd, 0x4c, 0xc0, 0xbd, 0x7e, 0xa7, 0xe8, 0x11, 0x34, 0x73,
+	0x36, 0xc6, 0x5c, 0x79, 0xa4, 0x3a, 0xf6, 0x67, 0xff, 0x70, 0x21, 0xc3, 0x41, 0xe5, 0x8c, 0x0b,
+	0x2d, 0x17, 0xa9, 0xc1, 0xec, 0xbe, 0x00, 0xe7, 0x4a, 0x9b, 0xba, 0x60, 0x9d, 0xe1, 0xa2, 0xfa,
+	0x3b, 0xed, 0x74, 0xb5, 0x5c, 0x6d, 0xee, 0x9c, 0xe5, 0x33, 0x34, 0xe1, 0xeb, 0xe2, 0x65, 0xe3,
+	0x39, 0x79, 0xdc, 0x03, 0xe7, 0x4a, 0x24, 0xea, 0x40, 0xeb, 0x75, 0x7c, 0xb0, 0xf7, 0x76, 0x70,
+	0xe2, 0xde, 0xa0, 0xdb, 0xb0, 0x95, 0x1c, 0x9f, 0xec, 0xed, 0x0f, 0xe2, 0xa1, 0x4b, 0xe8, 0x16,
+	0xd8, 0x87, 0x47, 0x87, 0xb1, 0xdb, 0xd8, 0x0f, 0xbf, 0x2e, 0x3b, 0xe4, 0xdb, 0xb2, 0x43, 0x7e,
+	0x2c, 0x3b, 0xe4, 0x83, 0x5f, 0x6f, 0x9e, 0x8b, 0x88, 0x95, 0x3c, 0x5a, 0xf3, 0x4a, 0xc7, 0xcd,
+	0xea, 0x79, 0xf6, 0x7f, 0x05, 0x00, 0x00, 0xff, 0xff, 0x32, 0x9f, 0xa8, 0x1c, 0x01, 0x04, 0x00,
+	0x00,
 }
diff --git a/networking/v1alpha3/sidecar.proto b/networking/v1alpha3/sidecar.proto
index f927fe919c..efd9d80863 100644
--- a/networking/v1alpha3/sidecar.proto
+++ b/networking/v1alpha3/sidecar.proto
@@ -195,20 +195,6 @@ message IstioEgressListener {
   repeated string hosts = 4;
 }
 
-// ConfigScope defines the visibility of an Istio configuration artifact in
-// a namespace when the namespace is imported.  By default all
-// configuration artifacts are public. Configurations with private scope
-// will not be imported when the namespace containing the configuration is
-// imported in a Sidecar.
-enum ConfigScope {
-  // Config with this scope are visible to all workloads in the mesh
-  PUBLIC = 0;
-
-  // Configs with this scope are visible to only workloads in the same
-  // namespace as the configuration resource.
-  PRIVATE = 1;
-}
-
 // WorkloadSelector specifies the criteria used to determine if the Gateway
 // or Sidecar resource can be applied to a proxy. The matching criteria
 // includes the metadata associated with a proxy, workload info such as
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index f5ddde8588..2fe372d65c 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -134,11 +134,20 @@ type VirtualService struct {
 	// be applied to any port that is not a HTTP or TLS port. The first rule
 	// matching an incoming request is used.
 	Tcp []*TCPRoute `protobuf:"bytes,4,rep,name=tcp" json:"tcp,omitempty"`
-	// The visibility setting associated with this VirtualService. Set to
-	// PRIVATE if this virtual service should not be exported, i.e. restrict
-	// the applicability of this virtual service to only workloads in the same
-	// namespace as the virtual service.
-	ConfigScope ConfigScope `protobuf:"varint,6,opt,name=config_scope,json=configScope,proto3,enum=istio.networking.v1alpha3.ConfigScope" json:"config_scope,omitempty"`
+	// A list of namespaces to which this virtual service is exported. Exporting a
+	// virtual service allows it to used by sidecars and gateways defined in
+	// other namespaces. This feature provides a mechanism for service owners
+	// and mesh administrators to control the visibility of virtual services
+	// across namespace boundaries.
+	//
+	// If no namespaces are specified then the virtual service is exported to all
+	// namespaces by default.
+	//
+	// The value "." is reserved and defines an export to the same namespace that
+	// the virtual service is declared in, similarly the value "*" is reserved and
+	// defines an export to all namespaces.
+	//
+	ExportTo []string `protobuf:"bytes,6,rep,name=export_to,json=exportTo" json:"export_to,omitempty"`
 }
 
 func (m *VirtualService) Reset()                    { *m = VirtualService{} }
@@ -181,11 +190,11 @@ func (m *VirtualService) GetTcp() []*TCPRoute {
 	return nil
 }
 
-func (m *VirtualService) GetConfigScope() ConfigScope {
+func (m *VirtualService) GetExportTo() []string {
 	if m != nil {
-		return m.ConfigScope
+		return m.ExportTo
 	}
-	return ConfigScope_PUBLIC
+	return nil
 }
 
 // Destination indicates the network addressable service to which the
@@ -2263,10 +2272,20 @@ func (m *VirtualService) MarshalTo(dAtA []byte) (int, error) {
 			i += n
 		}
 	}
-	if m.ConfigScope != 0 {
-		dAtA[i] = 0x30
-		i++
-		i = encodeVarintVirtualService(dAtA, i, uint64(m.ConfigScope))
+	if len(m.ExportTo) > 0 {
+		for _, s := range m.ExportTo {
+			dAtA[i] = 0x32
+			i++
+			l = len(s)
+			for l >= 1<<7 {
+				dAtA[i] = uint8(uint64(l)&0x7f | 0x80)
+				l >>= 7
+				i++
+			}
+			dAtA[i] = uint8(l)
+			i++
+			i += copy(dAtA[i:], s)
+		}
 	}
 	return i, nil
 }
@@ -3666,8 +3685,11 @@ func (m *VirtualService) Size() (n int) {
 			n += 1 + l + sovVirtualService(uint64(l))
 		}
 	}
-	if m.ConfigScope != 0 {
-		n += 1 + sovVirtualService(uint64(m.ConfigScope))
+	if len(m.ExportTo) > 0 {
+		for _, s := range m.ExportTo {
+			l = len(s)
+			n += 1 + l + sovVirtualService(uint64(l))
+		}
 	}
 	return n
 }
@@ -4461,10 +4483,10 @@ func (m *VirtualService) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 6:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConfigScope", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExportTo", wireType)
 			}
-			m.ConfigScope = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowVirtualService
@@ -4474,11 +4496,21 @@ func (m *VirtualService) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.ConfigScope |= (ConfigScope(b) & 0x7F) << shift
+				stringLen |= (uint64(b) & 0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthVirtualService
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExportTo = append(m.ExportTo, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipVirtualService(dAtA[iNdEx:])
@@ -9131,119 +9163,117 @@ func init() {
 }
 
 var fileDescriptorVirtualService = []byte{
-	// 1812 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x59, 0x4f, 0x73, 0x1b, 0x49,
-	0x15, 0xcf, 0x48, 0x1a, 0xfd, 0x79, 0x92, 0x1d, 0xbb, 0xf1, 0x66, 0x27, 0x62, 0x2b, 0x38, 0x5a,
-	0x76, 0x31, 0xb5, 0xac, 0x5c, 0x28, 0xb0, 0xb8, 0x96, 0x6c, 0x76, 0x6d, 0x27, 0x59, 0x85, 0x4a,
-	0x88, 0x6b, 0x64, 0xf6, 0xc0, 0x65, 0xaa, 0x35, 0xd3, 0x96, 0x86, 0x8c, 0x66, 0x86, 0xee, 0x1e,
-	0xdb, 0x2a, 0x8e, 0xfc, 0xb9, 0x43, 0x71, 0xa5, 0xf8, 0x14, 0x5c, 0xb8, 0x70, 0xe5, 0x44, 0xf1,
-	0x09, 0xa8, 0x54, 0x0e, 0x5c, 0xf9, 0x0a, 0x54, 0xff, 0x99, 0xd1, 0xd8, 0xb2, 0x35, 0x92, 0x09,
-	0x14, 0x27, 0xab, 0xbb, 0xdf, 0xef, 0xf5, 0xeb, 0xd7, 0xfd, 0xde, 0xfb, 0xcd, 0x33, 0x7c, 0x3b,
-	0x24, 0xfc, 0x2c, 0xa2, 0xaf, 0xfc, 0x70, 0xb4, 0x7b, 0xfa, 0x5d, 0x1c, 0xc4, 0x63, 0xfc, 0x60,
-	0xf7, 0xd4, 0xa7, 0x3c, 0xc1, 0x81, 0xc3, 0x08, 0x3d, 0xf5, 0x5d, 0xd2, 0x8d, 0x69, 0xc4, 0x23,
-	0x74, 0xd7, 0x67, 0xdc, 0x8f, 0xba, 0x33, 0x40, 0x37, 0x05, 0xb4, 0xef, 0x8d, 0xa2, 0x68, 0x14,
-	0x90, 0x5d, 0x29, 0x38, 0x4c, 0x4e, 0x76, 0xbd, 0x84, 0x62, 0xee, 0x47, 0xa1, 0x82, 0xce, 0xaf,
-	0x9f, 0x51, 0x1c, 0xc7, 0x84, 0x32, 0xbd, 0x7e, 0xff, 0x2a, 0x2b, 0x98, 0xef, 0x11, 0x17, 0x53,
-	0x25, 0xd2, 0xf9, 0x53, 0x09, 0xd6, 0xbf, 0x52, 0x76, 0x0d, 0x94, 0x59, 0x68, 0x0b, 0xcc, 0x71,
-	0xc4, 0x38, 0xb3, 0x8c, 0xed, 0xf2, 0x4e, 0xc3, 0x56, 0x03, 0xd4, 0x86, 0xfa, 0x08, 0x73, 0x72,
-	0x86, 0xa7, 0xcc, 0x2a, 0xc9, 0x85, 0x6c, 0x8c, 0xf6, 0xa0, 0x32, 0xe6, 0x3c, 0xb6, 0xca, 0xdb,
-	0xe5, 0x9d, 0x66, 0xef, 0x9b, 0xdd, 0x6b, 0x4f, 0xd4, 0xed, 0x1f, 0x1f, 0x1f, 0xd9, 0x51, 0xc2,
-	0x89, 0x2d, 0x11, 0xe8, 0xfb, 0x50, 0xe6, 0x6e, 0x6c, 0x55, 0x24, 0xf0, 0xfd, 0x05, 0xc0, 0xe3,
-	0x43, 0x8d, 0x13, 0xf2, 0x12, 0x16, 0x30, 0xcb, 0x2c, 0x86, 0x3d, 0x1f, 0xa4, 0xb0, 0x80, 0xa1,
-	0x67, 0xd0, 0x72, 0xa3, 0xf0, 0xc4, 0x1f, 0x39, 0xcc, 0x8d, 0x62, 0x62, 0x55, 0xb7, 0x8d, 0x9d,
-	0xf5, 0xde, 0x87, 0x0b, 0xf0, 0x87, 0x52, 0x7c, 0x20, 0xa4, 0xed, 0xa6, 0x3b, 0x1b, 0x74, 0x4e,
-	0xa1, 0xf9, 0x98, 0x30, 0xee, 0x87, 0xf2, 0x3e, 0x10, 0x82, 0x8a, 0x70, 0x93, 0x65, 0x6c, 0x1b,
-	0x3b, 0x0d, 0x5b, 0xfe, 0x46, 0x77, 0xa0, 0xca, 0x92, 0x21, 0x23, 0xdc, 0x2a, 0xc9, 0x59, 0x3d,
-	0x42, 0x3f, 0x84, 0x4a, 0x1c, 0x51, 0x6e, 0x95, 0xb7, 0x8d, 0x9d, 0x66, 0xef, 0x5b, 0x0b, 0x76,
-	0x3f, 0x8a, 0x28, 0x1f, 0x90, 0x80, 0xb8, 0x3c, 0xa2, 0xb6, 0x04, 0x75, 0xfe, 0x05, 0xd0, 0xc8,
-	0x9c, 0x88, 0xf6, 0xc1, 0x9c, 0x60, 0xee, 0x8e, 0xe5, 0x55, 0x35, 0x7b, 0x1f, 0x15, 0x78, 0xfe,
-	0x85, 0x90, 0xb5, 0xc9, 0xcf, 0x13, 0xc2, 0xb8, 0xad, 0x90, 0xe8, 0x09, 0x98, 0x54, 0xe8, 0x92,
-	0x97, 0xda, 0xec, 0xed, 0x2e, 0x73, 0x79, 0xb9, 0x93, 0xdb, 0x0a, 0x8d, 0x0e, 0xa1, 0x4e, 0x89,
-	0xe7, 0x53, 0xe2, 0x2e, 0x73, 0x30, 0xa9, 0x49, 0x8b, 0xdb, 0x19, 0x10, 0x7d, 0x01, 0x35, 0x4a,
-	0xce, 0xa8, 0xcf, 0x89, 0x55, 0x91, 0x3a, 0x3e, 0x2c, 0xd4, 0x21, 0xa5, 0xed, 0x14, 0x86, 0x3e,
-	0x82, 0xcd, 0x33, 0x32, 0x64, 0x91, 0xfb, 0x8a, 0x70, 0x27, 0x89, 0x47, 0x14, 0x7b, 0xc4, 0x32,
-	0xb7, 0x8d, 0x9d, 0xba, 0xbd, 0x91, 0x2d, 0xfc, 0x44, 0xcd, 0xa3, 0x07, 0x50, 0xe3, 0xfe, 0x84,
-	0x44, 0x09, 0x97, 0x2f, 0xa1, 0xd9, 0xbb, 0xdb, 0x55, 0x01, 0xd5, 0x4d, 0x03, 0xaa, 0xfb, 0x58,
-	0x07, 0x9c, 0x9d, 0x4a, 0xa2, 0x47, 0xc2, 0x46, 0x4e, 0x7d, 0xc2, 0xac, 0x9a, 0x04, 0x15, 0x3e,
-	0x77, 0xc2, 0xe9, 0xd4, 0x4e, 0x41, 0xe8, 0x10, 0xcc, 0x13, 0x9c, 0x04, 0xdc, 0xaa, 0x4b, 0xf4,
-	0xc7, 0x05, 0xe8, 0xa7, 0x42, 0xf6, 0x59, 0xf8, 0x33, 0xe2, 0x2a, 0x6f, 0x4b, 0x2c, 0x7a, 0x04,
-	0xd5, 0x89, 0x4f, 0x69, 0x44, 0xad, 0x46, 0xa1, 0x9f, 0xf2, 0x97, 0xa5, 0x51, 0xe8, 0x29, 0x34,
-	0xdd, 0x88, 0x32, 0x27, 0x8e, 0x02, 0xdf, 0x9d, 0x5a, 0x20, 0x95, 0x7c, 0xb0, 0x30, 0x0e, 0x28,
-	0x3b, 0x92, 0xc2, 0x36, 0xb8, 0xd9, 0x6f, 0x34, 0x84, 0x75, 0x91, 0x70, 0x42, 0xcf, 0x19, 0x13,
-	0xec, 0x11, 0xca, 0xac, 0xa6, 0x7c, 0x45, 0x3f, 0x58, 0xe6, 0x15, 0x75, 0xf7, 0x25, 0xb4, 0xaf,
-	0x90, 0x4f, 0x42, 0x4e, 0xa7, 0x07, 0x25, 0xcb, 0xb0, 0xd7, 0x70, 0x7e, 0x1e, 0x7d, 0x0a, 0xef,
-	0x52, 0x32, 0x89, 0x4e, 0x89, 0x43, 0x09, 0x8b, 0xa3, 0x90, 0x91, 0x6c, 0xb3, 0x96, 0xc8, 0x43,
-	0x12, 0xf3, 0x8e, 0x12, 0xb1, 0xb5, 0x44, 0x8a, 0xfd, 0x05, 0xbc, 0xab, 0xed, 0x9b, 0xc3, 0xae,
-	0x49, 0x43, 0x3f, 0x5f, 0xc1, 0xd0, 0x4b, 0xca, 0x67, 0x06, 0xbf, 0x83, 0xaf, 0x5a, 0x47, 0x7b,
-	0x70, 0x27, 0x33, 0x5c, 0x86, 0x5c, 0xb6, 0xf7, 0x7a, 0x66, 0xf7, 0x56, 0x6a, 0xb7, 0x14, 0x48,
-	0x91, 0xe7, 0x70, 0x27, 0x33, 0xfb, 0x22, 0xf2, 0xb6, 0xb4, 0xfa, 0xd1, 0x4a, 0x56, 0xe7, 0x55,
-	0xcf, 0x8c, 0xde, 0xc2, 0x57, 0x2c, 0xa3, 0x87, 0x50, 0x4b, 0xb7, 0xda, 0x90, 0x8f, 0xa2, 0xb3,
-	0x68, 0x2b, 0x25, 0x69, 0xa7, 0x90, 0xf6, 0x17, 0x80, 0xe6, 0xef, 0x14, 0x6d, 0x40, 0xf9, 0x15,
-	0x99, 0xea, 0xd4, 0x28, 0x7e, 0x8a, 0x0a, 0x73, 0x8a, 0x83, 0x84, 0xe8, 0xc4, 0xa8, 0x06, 0x9f,
-	0x96, 0xf6, 0x8c, 0x76, 0x1f, 0xda, 0xd7, 0x3b, 0x7b, 0x25, 0x4d, 0x5f, 0xc2, 0xdd, 0x6b, 0x1d,
-	0xb0, 0x8a, 0xa2, 0xce, 0x3f, 0xcb, 0x50, 0x4b, 0xdd, 0xf3, 0x42, 0x04, 0xbf, 0x54, 0x27, 0xb1,
-	0xcd, 0xde, 0x83, 0x62, 0xf7, 0xe8, 0xbf, 0x2f, 0x63, 0xa2, 0x52, 0x09, 0xb3, 0x53, 0x1d, 0xe8,
-	0xa5, 0x48, 0x9a, 0xea, 0x9c, 0x72, 0xdf, 0x1b, 0xea, 0xcb, 0x94, 0xb4, 0xff, 0x5c, 0x82, 0x8d,
-	0xcb, 0xcb, 0xe8, 0xc7, 0x50, 0x16, 0x45, 0x48, 0x95, 0x88, 0x87, 0x37, 0xd8, 0xa0, 0x3b, 0x20,
-	0x5c, 0xfa, 0xcd, 0x16, 0x8a, 0x84, 0x3e, 0xec, 0x79, 0xba, 0x5e, 0xdc, 0x48, 0xdf, 0xbe, 0xe7,
-	0x69, 0x7d, 0xd8, 0xf3, 0x44, 0x9d, 0x54, 0x51, 0x20, 0xf9, 0x43, 0xc3, 0xd6, 0xa3, 0xf6, 0x27,
-	0x50, 0x4f, 0x37, 0x5e, 0xe9, 0xe6, 0x3f, 0x81, 0x7a, 0xba, 0xc1, 0x4a, 0x17, 0xfd, 0x3b, 0x03,
-	0xea, 0x29, 0x5f, 0x10, 0x69, 0x3a, 0x5f, 0x59, 0x3f, 0x5e, 0xcc, 0x31, 0x64, 0x61, 0xdd, 0xe7,
-	0x9c, 0xfa, 0xc3, 0x84, 0x13, 0x96, 0xd6, 0xd6, 0xfd, 0x8b, 0xb5, 0x75, 0x51, 0x79, 0xbe, 0xa6,
-	0xae, 0x76, 0x7e, 0x2b, 0x8c, 0xd2, 0xdc, 0x07, 0x1d, 0x5c, 0x34, 0xea, 0x3b, 0x0b, 0xf4, 0x3d,
-	0xff, 0xde, 0x7f, 0xcf, 0xa6, 0x3f, 0x9a, 0xb0, 0x71, 0x99, 0x4e, 0xa0, 0x3d, 0x28, 0x27, 0xd4,
-	0xd7, 0x61, 0xb1, 0xa8, 0x1e, 0x0d, 0x38, 0xf5, 0xc3, 0x91, 0xc2, 0x0a, 0x88, 0x28, 0x66, 0xcc,
-	0x1d, 0x93, 0x49, 0x1a, 0x03, 0xcb, 0x82, 0x35, 0x4a, 0x16, 0x43, 0xc2, 0xc7, 0x91, 0xa7, 0x89,
-	0xc7, 0xd2, 0x78, 0x85, 0x42, 0x8f, 0xa1, 0x81, 0x13, 0x3e, 0x8e, 0xa8, 0xcf, 0xa7, 0x4b, 0xf0,
-	0x8e, 0xbc, 0x8a, 0x19, 0x10, 0xd9, 0xb3, 0xcc, 0xa9, 0x68, 0xe9, 0xde, 0x0a, 0x64, 0xac, 0x9b,
-	0xcf, 0x4e, 0x59, 0x3e, 0x15, 0xac, 0x52, 0x32, 0x45, 0xc1, 0x4e, 0xd6, 0x14, 0x01, 0x44, 0x43,
-	0x58, 0x63, 0x51, 0x42, 0x5d, 0xe2, 0x04, 0x78, 0x48, 0x02, 0xc1, 0x42, 0xc4, 0x6e, 0x9f, 0xad,
-	0xb2, 0xdb, 0x40, 0x2a, 0x78, 0x2e, 0xf1, 0x6a, 0xcb, 0x16, 0xcb, 0x4d, 0x5d, 0xe0, 0xfa, 0xf5,
-	0x8b, 0x5c, 0xbf, 0x3d, 0x84, 0x56, 0x41, 0x2a, 0x7d, 0x98, 0x8f, 0xb0, 0xe5, 0x7d, 0x99, 0x8b,
-	0xe0, 0xcf, 0x61, 0x73, 0xce, 0xc4, 0x95, 0x42, 0xf9, 0x6f, 0x26, 0x6c, 0x5d, 0xc5, 0x56, 0x51,
-	0x1f, 0x9a, 0xde, 0x6c, 0xb8, 0xc4, 0x6b, 0xcd, 0x3f, 0xff, 0x3c, 0x54, 0x64, 0xad, 0x33, 0xe2,
-	0x8f, 0xc6, 0x8a, 0xdd, 0x9b, 0xb6, 0x1e, 0x2d, 0xa2, 0x2b, 0xe5, 0x22, 0xba, 0xf2, 0x1b, 0xe3,
-	0x7a, 0xbe, 0xa2, 0x3e, 0x91, 0x7e, 0xb4, 0x22, 0x3d, 0x7f, 0xeb, 0xd4, 0xc5, 0x2c, 0xa0, 0x2e,
-	0xbf, 0x34, 0xae, 0xe5, 0x2e, 0x55, 0x79, 0x82, 0x67, 0x37, 0x3d, 0xc1, 0x0d, 0x69, 0x4c, 0x6d,
-	0x75, 0x1a, 0xf3, 0x7f, 0x48, 0x42, 0x38, 0x6c, 0xfc, 0xef, 0xdf, 0x72, 0xe7, 0x2f, 0x25, 0xd8,
-	0x9c, 0x2b, 0x24, 0x68, 0x17, 0xbe, 0x96, 0x03, 0x3b, 0x2c, 0x19, 0x86, 0x24, 0xeb, 0x16, 0xa0,
-	0xdc, 0xd2, 0x40, 0xad, 0x64, 0x69, 0xac, 0x94, 0x4b, 0x63, 0xef, 0x67, 0x69, 0x4c, 0xe1, 0x65,
-	0xee, 0x6e, 0xa4, 0x79, 0x48, 0x21, 0x91, 0x7b, 0x39, 0xd7, 0x55, 0x0a, 0xe9, 0xef, 0x9c, 0xb9,
-	0x2b, 0x25, 0x3b, 0xf3, 0x52, 0xb2, 0xfb, 0x8f, 0x13, 0xd1, 0x3f, 0x4a, 0x80, 0xe6, 0xf9, 0x01,
-	0xfa, 0x3a, 0x34, 0x58, 0xe8, 0x3b, 0xf9, 0x36, 0x4b, 0x9d, 0x85, 0x7e, 0x5f, 0x76, 0x5a, 0xae,
-	0xf1, 0x6f, 0xa9, 0xd0, 0xbf, 0xe5, 0x45, 0xfe, 0xad, 0x5c, 0xe1, 0x5f, 0xef, 0xb2, 0x7f, 0xcd,
-	0xc2, 0x8f, 0xa2, 0xf9, 0xc3, 0xac, 0xe4, 0xe0, 0xea, 0xdb, 0x76, 0xf0, 0x23, 0x68, 0xe5, 0x9b,
-	0x09, 0x02, 0x9b, 0xd2, 0x90, 0x86, 0xa2, 0x17, 0xef, 0xe5, 0xcb, 0xbb, 0xc2, 0xcf, 0x26, 0x3a,
-	0x9f, 0x41, 0x33, 0xd7, 0x48, 0x58, 0x19, 0x4e, 0xa0, 0x99, 0xab, 0x61, 0xe8, 0x0e, 0x98, 0xe4,
-	0x1c, 0xbb, 0xba, 0x0f, 0xd4, 0xbf, 0x65, 0xab, 0x21, 0xb2, 0xa0, 0x1a, 0x53, 0x72, 0xe2, 0x9f,
-	0x2b, 0x0d, 0xfd, 0x5b, 0xb6, 0x1e, 0x0b, 0x04, 0x25, 0x23, 0x72, 0xae, 0xde, 0xbf, 0x40, 0xc8,
-	0xe1, 0x41, 0x0b, 0x40, 0xf2, 0x35, 0x87, 0x4f, 0x63, 0xd2, 0xf9, 0xb5, 0xa1, 0xbb, 0x3e, 0x44,
-	0xf8, 0xa7, 0x0d, 0x75, 0xcc, 0x39, 0x99, 0xc4, 0xf2, 0xf1, 0x88, 0x80, 0xcd, 0xc6, 0x68, 0x1f,
-	0x6e, 0xc7, 0x84, 0x3a, 0x9c, 0x4e, 0x9d, 0xb4, 0xb7, 0x51, 0x2a, 0xea, 0x6d, 0xac, 0xc5, 0x84,
-	0x1e, 0xd3, 0xe9, 0xb1, 0xee, 0x70, 0xdc, 0x15, 0x5f, 0x25, 0x42, 0x41, 0x14, 0xea, 0xa8, 0x94,
-	0xcd, 0x8b, 0xe9, 0xcb, 0xb0, 0xf3, 0x87, 0x12, 0xc0, 0xac, 0x15, 0x80, 0xee, 0x43, 0x0b, 0x07,
-	0x41, 0x74, 0xe6, 0x44, 0xd4, 0x1f, 0xf9, 0xa1, 0x7e, 0xc9, 0x4d, 0x39, 0xf7, 0x52, 0x4e, 0x89,
-	0x77, 0xa8, 0x44, 0x14, 0xd9, 0x4a, 0x9f, 0xb1, 0xc2, 0xbd, 0x50, 0x73, 0x33, 0xa1, 0x0b, 0x95,
-	0x52, 0x0b, 0xa5, 0x39, 0xfd, 0x03, 0x58, 0x27, 0xe7, 0x71, 0x74, 0xa9, 0x24, 0x36, 0xec, 0x35,
-	0x35, 0x9b, 0x8a, 0xf5, 0xa0, 0x36, 0xc1, 0xe7, 0x0e, 0x1e, 0xa9, 0xbe, 0xcf, 0xc2, 0x83, 0x57,
-	0x27, 0xf8, 0x7c, 0x7f, 0x44, 0xd0, 0x97, 0xb0, 0xa9, 0xf6, 0x77, 0x29, 0xf1, 0x48, 0xc8, 0x7d,
-	0x1c, 0x30, 0xdd, 0x12, 0x6a, 0xcf, 0xa1, 0x0f, 0xa2, 0x28, 0xf8, 0x4a, 0xbc, 0x3f, 0x7b, 0x43,
-	0x82, 0x0e, 0x67, 0x98, 0xce, 0xef, 0x4d, 0x40, 0xf3, 0x5d, 0x1b, 0xf4, 0x0c, 0x4c, 0x8f, 0x04,
-	0x78, 0xba, 0xcc, 0x47, 0xe3, 0x1c, 0xba, 0xfb, 0x58, 0x40, 0x6d, 0xa5, 0x41, 0xa8, 0xc2, 0xc3,
-	0x34, 0x99, 0xae, 0xac, 0x6a, 0x5f, 0x40, 0x6d, 0xa5, 0xa1, 0xfd, 0xab, 0x12, 0x98, 0x52, 0x37,
-	0x7a, 0x0f, 0x6a, 0x31, 0xa1, 0x2e, 0x09, 0xd5, 0xc3, 0x35, 0x65, 0x65, 0x4d, 0xa7, 0xd0, 0x43,
-	0x68, 0x9e, 0xf8, 0xe7, 0xc4, 0x73, 0xd4, 0x19, 0x8a, 0x9e, 0x53, 0xff, 0x96, 0x0d, 0x52, 0x5e,
-	0xe9, 0xee, 0xc3, 0xa6, 0xb8, 0xa0, 0x50, 0xb9, 0x48, 0xeb, 0x28, 0x17, 0xeb, 0xd8, 0xc8, 0xa1,
-	0x94, 0xa6, 0x03, 0x00, 0x6d, 0xd2, 0xec, 0x72, 0x17, 0xd5, 0xf5, 0x23, 0x25, 0x6c, 0xe7, 0x50,
-	0x07, 0x9b, 0x70, 0x7b, 0xcc, 0x79, 0xac, 0xcc, 0x90, 0xb1, 0xd5, 0x7e, 0x6d, 0x80, 0x29, 0xfd,
-	0x52, 0xe0, 0x86, 0xfb, 0xd0, 0x94, 0x50, 0xc6, 0x31, 0x4f, 0x98, 0xaa, 0x94, 0xe2, 0xac, 0x62,
-	0x72, 0x20, 0xe7, 0x84, 0xc8, 0x88, 0xc6, 0x6e, 0x2a, 0x92, 0x86, 0x34, 0x88, 0xc9, 0x99, 0x88,
-	0x00, 0xf4, 0x1c, 0x22, 0xdb, 0x77, 0x95, 0x54, 0x44, 0x4e, 0x3e, 0x91, 0xcd, 0xb9, 0xb7, 0x71,
-	0xce, 0x16, 0x80, 0xdc, 0x40, 0xa5, 0x8f, 0xa7, 0xd0, 0xca, 0xb7, 0x92, 0x45, 0x3a, 0x0a, 0x93,
-	0xc9, 0x90, 0x50, 0x79, 0xce, 0x35, 0x91, 0x8e, 0xd4, 0x18, 0x6d, 0x41, 0x25, 0xc4, 0xfa, 0x4b,
-	0x4c, 0xd8, 0x25, 0x47, 0x07, 0x55, 0x55, 0x60, 0x3a, 0xdf, 0x80, 0x9a, 0xde, 0x6c, 0x96, 0x91,
-	0x85, 0x06, 0x43, 0x67, 0xe4, 0x83, 0xee, 0x5f, 0xdf, 0xdc, 0x33, 0xfe, 0xfe, 0xe6, 0x9e, 0xf1,
-	0xfa, 0xcd, 0x3d, 0xe3, 0xa7, 0xdb, 0xca, 0x66, 0x3f, 0xda, 0xc5, 0xb1, 0xbf, 0x7b, 0xc5, 0xff,
-	0x22, 0x86, 0x55, 0x79, 0xf3, 0x0f, 0xfe, 0x1d, 0x00, 0x00, 0xff, 0xff, 0x2f, 0xaf, 0xea, 0xb9,
-	0x2f, 0x19, 0x00, 0x00,
+	// 1785 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x59, 0x4f, 0x73, 0xe3, 0x48,
+	0x15, 0x1f, 0xd9, 0x96, 0xff, 0x3c, 0x3b, 0x19, 0xa7, 0xc9, 0x66, 0x15, 0xef, 0x56, 0xc8, 0x7a,
+	0x59, 0x08, 0xb5, 0xac, 0x5d, 0x24, 0xb0, 0xa4, 0x96, 0x6c, 0x76, 0xed, 0x64, 0x66, 0x3d, 0xd4,
+	0x0c, 0x49, 0xc9, 0x61, 0x0e, 0x5c, 0x54, 0xb2, 0xd4, 0xb1, 0xc5, 0xc8, 0x6a, 0xd1, 0x6a, 0x25,
+	0x76, 0x71, 0xe4, 0xdf, 0x19, 0x8a, 0x2b, 0xc5, 0xf7, 0xe0, 0xc2, 0x95, 0x13, 0xc5, 0x27, 0xa0,
+	0xa6, 0xe6, 0xc0, 0x95, 0xaf, 0x40, 0x75, 0xb7, 0x24, 0x2b, 0x71, 0x62, 0xd9, 0x61, 0xa0, 0x38,
+	0xc5, 0xdd, 0xfd, 0x7e, 0xbf, 0x7e, 0xfd, 0xba, 0xfb, 0xbd, 0x9f, 0x3a, 0xf0, 0x6d, 0x0f, 0xb3,
+	0x6b, 0x42, 0x5f, 0x39, 0xde, 0xb0, 0x7d, 0xf5, 0x5d, 0xd3, 0xf5, 0x47, 0xe6, 0x41, 0xfb, 0xca,
+	0xa1, 0x2c, 0x34, 0x5d, 0x23, 0xc0, 0xf4, 0xca, 0xb1, 0x70, 0xcb, 0xa7, 0x84, 0x11, 0xb4, 0xed,
+	0x04, 0xcc, 0x21, 0xad, 0x19, 0xa0, 0x15, 0x03, 0x1a, 0x3b, 0x43, 0x42, 0x86, 0x2e, 0x6e, 0x0b,
+	0xc3, 0x41, 0x78, 0xd9, 0xb6, 0x43, 0x6a, 0x32, 0x87, 0x78, 0x12, 0x3a, 0x3f, 0x7e, 0x4d, 0x4d,
+	0xdf, 0xc7, 0x34, 0x90, 0xe3, 0xcd, 0xdf, 0xe6, 0x60, 0xfd, 0xa5, 0x9c, 0xb4, 0x2f, 0xe7, 0x44,
+	0x9b, 0xa0, 0x8e, 0x48, 0xc0, 0x02, 0x4d, 0xd9, 0xcd, 0xef, 0x55, 0x74, 0xd9, 0x40, 0x0d, 0x28,
+	0x0f, 0x4d, 0x86, 0xaf, 0xcd, 0x69, 0xa0, 0xe5, 0xc4, 0x40, 0xd2, 0x46, 0x87, 0x50, 0x18, 0x31,
+	0xe6, 0x6b, 0xf9, 0xdd, 0xfc, 0x5e, 0x75, 0xff, 0x1b, 0xad, 0x7b, 0xdd, 0x6d, 0xf5, 0x2e, 0x2e,
+	0xce, 0x75, 0x12, 0x32, 0xac, 0x0b, 0x04, 0xfa, 0x3e, 0xe4, 0x99, 0xe5, 0x6b, 0x05, 0x01, 0xfc,
+	0x70, 0x01, 0xf0, 0xe2, 0x24, 0xc2, 0x71, 0x7b, 0x01, 0x73, 0x03, 0x4d, 0xcd, 0x86, 0x3d, 0xef,
+	0xc7, 0x30, 0x37, 0x40, 0xef, 0x41, 0x05, 0x4f, 0x7c, 0x42, 0x99, 0xc1, 0x88, 0x56, 0x94, 0x8b,
+	0x90, 0x1d, 0x17, 0xa4, 0x79, 0x05, 0xd5, 0x53, 0x1c, 0x30, 0xc7, 0x13, 0xe1, 0x43, 0x08, 0x0a,
+	0x7c, 0xe1, 0x9a, 0xb2, 0xab, 0xec, 0x55, 0x74, 0xf1, 0x1b, 0x6d, 0x41, 0x31, 0x08, 0x07, 0x01,
+	0x66, 0x5a, 0x4e, 0xf4, 0x46, 0x2d, 0xf4, 0x43, 0x28, 0x70, 0x12, 0x2d, 0xbf, 0xab, 0xec, 0x55,
+	0xf7, 0xbf, 0xb5, 0xc0, 0x9f, 0x73, 0x42, 0x59, 0x1f, 0xbb, 0xd8, 0x62, 0x84, 0xea, 0x02, 0xd4,
+	0xfc, 0x17, 0x40, 0x25, 0x09, 0x0b, 0xea, 0x80, 0x3a, 0x36, 0x99, 0x35, 0x12, 0xc1, 0xaf, 0xee,
+	0x7f, 0x9c, 0x11, 0xcb, 0x17, 0xdc, 0x56, 0xc7, 0x3f, 0x0f, 0x71, 0xc0, 0x74, 0x89, 0x44, 0x4f,
+	0x40, 0xa5, 0x9c, 0x4b, 0x6c, 0x53, 0x75, 0xbf, 0xbd, 0xcc, 0x76, 0xa4, 0x56, 0xae, 0x4b, 0x34,
+	0x3a, 0x81, 0x32, 0xc5, 0xb6, 0x43, 0xb1, 0xb5, 0xcc, 0xc2, 0x04, 0x53, 0x64, 0xae, 0x27, 0x40,
+	0xf4, 0x25, 0x94, 0x28, 0xbe, 0xa6, 0x0e, 0xc3, 0x5a, 0x41, 0x70, 0x7c, 0x33, 0x93, 0x43, 0x58,
+	0xeb, 0x31, 0x0c, 0x7d, 0x0c, 0x1b, 0xd7, 0x78, 0x10, 0x10, 0xeb, 0x15, 0x66, 0x46, 0xe8, 0x0f,
+	0xa9, 0x69, 0x63, 0x4d, 0xdd, 0x55, 0xf6, 0xca, 0x7a, 0x3d, 0x19, 0xf8, 0x89, 0xec, 0x47, 0x07,
+	0x50, 0x62, 0xce, 0x18, 0x93, 0x90, 0x69, 0x45, 0x31, 0xdd, 0x76, 0x4b, 0x9e, 0xff, 0x56, 0x7c,
+	0xfe, 0x5b, 0xa7, 0xd1, 0xfd, 0xd0, 0x63, 0x4b, 0x74, 0xcc, 0x7d, 0x64, 0xd4, 0xc1, 0x81, 0x56,
+	0x12, 0xa0, 0xcc, 0x03, 0x8c, 0x19, 0x9d, 0xea, 0x31, 0x08, 0x9d, 0x80, 0x7a, 0x69, 0x86, 0x2e,
+	0xd3, 0xca, 0x02, 0xfd, 0x49, 0x06, 0xfa, 0x29, 0xb7, 0x7d, 0xe6, 0xfd, 0x0c, 0x5b, 0x32, 0xda,
+	0x02, 0x8b, 0x8e, 0xa1, 0x38, 0x76, 0x28, 0x25, 0x54, 0xab, 0x64, 0xc6, 0x29, 0xbd, 0x59, 0x11,
+	0x0a, 0x3d, 0x85, 0xaa, 0x45, 0x68, 0x60, 0xf8, 0xc4, 0x75, 0xac, 0xa9, 0x06, 0x82, 0xe4, 0xa3,
+	0x05, 0x24, 0x27, 0x84, 0x06, 0xe7, 0xc2, 0x58, 0x07, 0x2b, 0xf9, 0x8d, 0x06, 0xb0, 0xce, 0xf3,
+	0x83, 0x67, 0x1b, 0x23, 0x6c, 0xda, 0x98, 0x06, 0x5a, 0x55, 0x9c, 0xa2, 0x1f, 0x2c, 0x73, 0x8a,
+	0x5a, 0x1d, 0x01, 0xed, 0x49, 0xe4, 0x13, 0x8f, 0xd1, 0x69, 0x37, 0xa7, 0x29, 0xfa, 0x9a, 0x99,
+	0xee, 0x47, 0x9f, 0xc1, 0xbb, 0x14, 0x8f, 0xc9, 0x15, 0x36, 0x28, 0x0e, 0x7c, 0xe2, 0x05, 0x38,
+	0x99, 0xac, 0xc6, 0x2f, 0xa5, 0xc0, 0xbc, 0x23, 0x4d, 0xf4, 0xc8, 0x22, 0xc6, 0xfe, 0x02, 0xde,
+	0x8d, 0xfc, 0x9b, 0xc3, 0xae, 0x09, 0x47, 0xbf, 0x58, 0xc1, 0xd1, 0x5b, 0xe4, 0x33, 0x87, 0xdf,
+	0x31, 0xef, 0x1a, 0x47, 0x87, 0xb0, 0x95, 0x38, 0x2e, 0xae, 0x5c, 0x32, 0xf7, 0x7a, 0xe2, 0xf7,
+	0x66, 0xec, 0xb7, 0x30, 0x88, 0x91, 0x13, 0xd8, 0x4a, 0xdc, 0xbe, 0x89, 0x7c, 0x2c, 0xbc, 0x3e,
+	0x5e, 0xc9, 0xeb, 0x34, 0xf5, 0xcc, 0xe9, 0x4d, 0xf3, 0x8e, 0x61, 0x74, 0x04, 0xa5, 0x78, 0xaa,
+	0xba, 0x38, 0x14, 0xcd, 0x45, 0x53, 0x49, 0x4b, 0x3d, 0x86, 0x34, 0xbe, 0x04, 0x34, 0xbf, 0xa7,
+	0xa8, 0x0e, 0xf9, 0x57, 0x78, 0x1a, 0xa5, 0x46, 0xfe, 0x93, 0xd7, 0x8c, 0x2b, 0xd3, 0x0d, 0x71,
+	0x94, 0x18, 0x65, 0xe3, 0xb3, 0xdc, 0xa1, 0xd2, 0xe8, 0x41, 0xe3, 0xfe, 0x60, 0xaf, 0xc4, 0xf4,
+	0x15, 0x6c, 0xdf, 0x1b, 0x80, 0x55, 0x88, 0x9a, 0xff, 0xcc, 0x43, 0x29, 0x0e, 0xcf, 0x0b, 0x7e,
+	0xf9, 0x05, 0x9d, 0xc0, 0x56, 0xf7, 0x0f, 0xb2, 0xc3, 0x13, 0xfd, 0x3d, 0xf3, 0xb1, 0x4c, 0x25,
+	0x81, 0x1e, 0x73, 0xa0, 0x33, 0x9e, 0x34, 0xe5, 0x3a, 0xc5, 0xbc, 0x0f, 0xe4, 0x4b, 0x48, 0x1a,
+	0x7f, 0xce, 0x41, 0xfd, 0xf6, 0x30, 0xfa, 0x31, 0xe4, 0x79, 0x11, 0x92, 0x25, 0xe2, 0xe8, 0x01,
+	0x13, 0xb4, 0xfa, 0x98, 0x89, 0xb8, 0xe9, 0x9c, 0x88, 0xf3, 0x99, 0xb6, 0x1d, 0xd5, 0x8b, 0x07,
+	0xf1, 0x75, 0x6c, 0x3b, 0xe2, 0x33, 0x6d, 0x9b, 0xd7, 0x49, 0x79, 0x0b, 0x84, 0x22, 0xa8, 0xe8,
+	0x51, 0xab, 0xf1, 0x29, 0x94, 0xe3, 0x89, 0x57, 0xda, 0xf9, 0x4f, 0xa1, 0x1c, 0x4f, 0xb0, 0xd2,
+	0x46, 0xff, 0x5e, 0x81, 0x72, 0xac, 0x00, 0x78, 0x9a, 0x4e, 0x57, 0xd6, 0x4f, 0x16, 0xab, 0x06,
+	0x51, 0x58, 0x3b, 0x8c, 0x51, 0x67, 0x10, 0x32, 0x1c, 0xc4, 0xb5, 0xb5, 0x73, 0xb3, 0xb6, 0x2e,
+	0x2a, 0xcf, 0xf7, 0xd4, 0xd5, 0xe6, 0xef, 0xb8, 0x53, 0x91, 0x9a, 0x41, 0xdd, 0x9b, 0x4e, 0x7d,
+	0x67, 0x01, 0xdf, 0xf3, 0xef, 0xfd, 0xf7, 0x7c, 0xfa, 0x93, 0x0a, 0xf5, 0xdb, 0x72, 0x02, 0x1d,
+	0x42, 0x3e, 0xa4, 0x4e, 0x74, 0x2d, 0x16, 0xd5, 0xa3, 0x3e, 0xa3, 0x8e, 0x37, 0x94, 0x58, 0x0e,
+	0xe1, 0xc5, 0x2c, 0xb0, 0x46, 0x78, 0x1c, 0xdf, 0x81, 0x65, 0xc1, 0x11, 0x4a, 0x14, 0x43, 0xcc,
+	0x46, 0xc4, 0x8e, 0x84, 0xc7, 0xd2, 0x78, 0x89, 0x42, 0xa7, 0x50, 0x31, 0x43, 0x36, 0x22, 0xd4,
+	0x61, 0xd3, 0x25, 0x74, 0x47, 0x9a, 0x62, 0x06, 0x44, 0xfa, 0x2c, 0x73, 0x4a, 0xa1, 0x79, 0xb8,
+	0x82, 0x18, 0x6b, 0xa5, 0xb3, 0x53, 0x92, 0x4f, 0xb9, 0xaa, 0x14, 0x4a, 0x91, 0xab, 0x93, 0x35,
+	0x29, 0x00, 0xd1, 0x00, 0xd6, 0x02, 0x12, 0x52, 0x0b, 0x1b, 0xae, 0x39, 0xc0, 0x2e, 0x57, 0x21,
+	0x7c, 0xb6, 0xcf, 0x57, 0x99, 0xad, 0x2f, 0x08, 0x9e, 0x0b, 0xbc, 0x9c, 0xb2, 0x16, 0xa4, 0xba,
+	0x6e, 0xa8, 0xf7, 0xf2, 0x4d, 0xf5, 0xde, 0x18, 0x40, 0x2d, 0x23, 0x95, 0x1e, 0xa5, 0x6f, 0xd8,
+	0xf2, 0xb1, 0x4c, 0xdd, 0xe0, 0x2f, 0x60, 0x63, 0xce, 0xc5, 0x95, 0xae, 0xf2, 0xdf, 0x54, 0xd8,
+	0xbc, 0x4b, 0xad, 0xa2, 0x1e, 0x54, 0xed, 0x59, 0x73, 0x89, 0xd3, 0x9a, 0x3e, 0xfe, 0x69, 0x28,
+	0xcf, 0x5a, 0xd7, 0xd8, 0x19, 0x8e, 0xa4, 0xba, 0x57, 0xf5, 0xa8, 0xb5, 0x48, 0xae, 0xe4, 0xb3,
+	0xe4, 0xca, 0x6f, 0x94, 0xfb, 0xf5, 0x8a, 0xfc, 0xe8, 0xf9, 0xd1, 0x8a, 0xf2, 0xfc, 0xad, 0x4b,
+	0x17, 0x35, 0x43, 0xba, 0xfc, 0x52, 0xb9, 0x57, 0xbb, 0x14, 0xc5, 0x0a, 0x9e, 0x3d, 0x74, 0x05,
+	0x0f, 0x94, 0x31, 0xa5, 0xd5, 0x65, 0xcc, 0xff, 0xa1, 0x08, 0x61, 0x50, 0xff, 0xdf, 0x9f, 0xe5,
+	0xe6, 0x5f, 0x72, 0xb0, 0x31, 0x57, 0x48, 0x50, 0x1b, 0xbe, 0x96, 0x02, 0x1b, 0x41, 0x38, 0xf0,
+	0x70, 0xf2, 0xfd, 0x8f, 0x52, 0x43, 0x7d, 0x39, 0x92, 0xa4, 0xb1, 0x5c, 0x2a, 0x8d, 0x7d, 0x98,
+	0xa4, 0x31, 0x89, 0x17, 0xb9, 0xbb, 0x12, 0xe7, 0x21, 0x89, 0x44, 0xd6, 0xed, 0x5c, 0x57, 0xc8,
+	0x94, 0xbf, 0x73, 0xee, 0xae, 0x94, 0xec, 0xd4, 0x5b, 0xc9, 0xee, 0x3f, 0x4e, 0x44, 0xff, 0xc8,
+	0x01, 0x9a, 0xd7, 0x07, 0xe8, 0x3d, 0xa8, 0x04, 0x9e, 0x63, 0xa4, 0x1f, 0x4e, 0xca, 0x81, 0xe7,
+	0xf4, 0xc4, 0xdb, 0xc9, 0x3d, 0xf1, 0xcd, 0x65, 0xc6, 0x37, 0xbf, 0x28, 0xbe, 0x85, 0x3b, 0xe2,
+	0x6b, 0xdf, 0x8e, 0xaf, 0x9a, 0xf9, 0x51, 0x34, 0xbf, 0x98, 0x95, 0x02, 0x5c, 0x7c, 0xdb, 0x01,
+	0x3e, 0x86, 0x5a, 0xfa, 0x31, 0x81, 0x63, 0x63, 0x19, 0x52, 0x91, 0xf2, 0xe2, 0xfd, 0x74, 0x79,
+	0x97, 0xf8, 0x59, 0x47, 0xf3, 0x73, 0xa8, 0xa6, 0x1e, 0x12, 0x56, 0x86, 0x63, 0xa8, 0xa6, 0x6a,
+	0x18, 0xda, 0x02, 0x15, 0x4f, 0x4c, 0x2b, 0x7a, 0x07, 0xea, 0x3d, 0xd2, 0x65, 0x13, 0x69, 0x50,
+	0xf4, 0x29, 0xbe, 0x74, 0x26, 0x92, 0xa1, 0xf7, 0x48, 0x8f, 0xda, 0x1c, 0x41, 0xf1, 0x10, 0x4f,
+	0xe4, 0xf9, 0xe7, 0x08, 0xd1, 0xec, 0xd6, 0x00, 0x84, 0x5e, 0x33, 0xd8, 0xd4, 0xc7, 0xcd, 0x5f,
+	0x2b, 0xd1, 0xab, 0x0f, 0xe6, 0xf1, 0x69, 0x40, 0xd9, 0x64, 0x0c, 0x8f, 0x7d, 0x71, 0x78, 0xf8,
+	0x85, 0x4d, 0xda, 0xa8, 0x03, 0x8f, 0x7d, 0x4c, 0x0d, 0x46, 0xa7, 0x46, 0xfc, 0xb6, 0x91, 0xcb,
+	0x7a, 0xdb, 0x58, 0xf3, 0x31, 0xbd, 0xa0, 0xd3, 0x8b, 0xe8, 0x85, 0x63, 0x9b, 0x7f, 0x95, 0x70,
+	0x02, 0xe2, 0x45, 0xb7, 0x52, 0x3c, 0x5e, 0x4c, 0xcf, 0xbc, 0xe6, 0x1f, 0x73, 0x00, 0xb3, 0xa7,
+	0x00, 0xf4, 0x01, 0xd4, 0x4c, 0xd7, 0x25, 0xd7, 0x06, 0xa1, 0xce, 0xd0, 0xf1, 0xa2, 0x93, 0x5c,
+	0x15, 0x7d, 0x67, 0xa2, 0x8b, 0x9f, 0x43, 0x69, 0x22, 0xc5, 0x56, 0x7c, 0x8c, 0x25, 0xee, 0x85,
+	0xec, 0x9b, 0x19, 0xdd, 0xa8, 0x94, 0x91, 0x51, 0x9c, 0xd3, 0x3f, 0x82, 0x75, 0x3c, 0xf1, 0xc9,
+	0xad, 0x92, 0x58, 0xd1, 0xd7, 0x64, 0x6f, 0x6c, 0xb6, 0x0f, 0xa5, 0xb1, 0x39, 0x31, 0xcc, 0xa1,
+	0x7c, 0xf7, 0x59, 0xb8, 0xf0, 0xe2, 0xd8, 0x9c, 0x74, 0x86, 0x18, 0x7d, 0x05, 0x1b, 0x72, 0x7e,
+	0x8b, 0x62, 0x1b, 0x7b, 0xcc, 0x31, 0xdd, 0x20, 0x7a, 0x12, 0x6a, 0xcc, 0xa1, 0xbb, 0x84, 0xb8,
+	0x2f, 0xf9, 0xf9, 0xd3, 0xeb, 0x02, 0x74, 0x32, 0xc3, 0x34, 0xff, 0xa0, 0x02, 0x9a, 0x7f, 0xb5,
+	0x41, 0xcf, 0x40, 0xb5, 0xb1, 0x6b, 0x4e, 0x97, 0xf9, 0x68, 0x9c, 0x43, 0xb7, 0x4e, 0x39, 0x54,
+	0x97, 0x0c, 0x9c, 0xca, 0x1c, 0xc4, 0xc9, 0x74, 0x65, 0xaa, 0x0e, 0x87, 0xea, 0x92, 0xa1, 0xf1,
+	0xab, 0x1c, 0xa8, 0x82, 0x1b, 0xbd, 0x0f, 0x25, 0x1f, 0x53, 0x0b, 0x7b, 0xf2, 0xe0, 0xaa, 0xa2,
+	0xb2, 0xc6, 0x5d, 0xe8, 0x08, 0xaa, 0x97, 0xce, 0x04, 0xdb, 0x86, 0x5c, 0x43, 0xd6, 0x71, 0xea,
+	0x3d, 0xd2, 0x41, 0xd8, 0x4b, 0xee, 0x1e, 0x6c, 0xf0, 0x0d, 0xf2, 0x64, 0x88, 0x22, 0x8e, 0x7c,
+	0x36, 0x47, 0x3d, 0x85, 0x92, 0x4c, 0x5d, 0x80, 0xc8, 0xa5, 0xd9, 0xe6, 0x2e, 0xaa, 0xeb, 0xe7,
+	0xd2, 0x58, 0x4f, 0xa1, 0xba, 0x1b, 0xf0, 0x78, 0xc4, 0x98, 0x2f, 0xdd, 0x10, 0x77, 0xab, 0xf1,
+	0x5a, 0x01, 0x55, 0xc4, 0x25, 0x23, 0x0c, 0x1f, 0x40, 0x55, 0x40, 0x03, 0x66, 0xb2, 0x30, 0x90,
+	0x95, 0x92, 0xaf, 0x95, 0x77, 0xf6, 0x45, 0x1f, 0x37, 0x19, 0x52, 0xdf, 0x8a, 0x4d, 0xe2, 0x2b,
+	0x0d, 0xbc, 0x73, 0x66, 0xc2, 0x01, 0xfb, 0x06, 0x16, 0xcf, 0x77, 0x85, 0xd8, 0x44, 0x74, 0x3e,
+	0x11, 0x8f, 0x73, 0x6f, 0x63, 0x9d, 0x35, 0x00, 0x31, 0x81, 0x4c, 0x1f, 0x4f, 0xa1, 0x96, 0x7e,
+	0x4a, 0xe6, 0xe9, 0xc8, 0x0b, 0xc7, 0x03, 0x4c, 0xc5, 0x3a, 0xd7, 0x78, 0x3a, 0x92, 0x6d, 0xb4,
+	0x09, 0x05, 0xcf, 0x8c, 0xbe, 0xc4, 0xb8, 0x5f, 0xa2, 0xd5, 0x2d, 0xca, 0x02, 0xd3, 0xfc, 0x3a,
+	0x94, 0xa2, 0xc9, 0x66, 0x19, 0x99, 0x33, 0x28, 0x51, 0x46, 0xee, 0xb6, 0xfe, 0xfa, 0x66, 0x47,
+	0xf9, 0xfb, 0x9b, 0x1d, 0xe5, 0xf5, 0x9b, 0x1d, 0xe5, 0xa7, 0xbb, 0xd2, 0x67, 0x87, 0xb4, 0x4d,
+	0xdf, 0x69, 0xdf, 0xf1, 0x0f, 0x8c, 0x41, 0x51, 0xec, 0xfc, 0xc1, 0xbf, 0x03, 0x00, 0x00, 0xff,
+	0xff, 0x3d, 0x3a, 0x29, 0x1e, 0xde, 0x18, 0x00, 0x00,
 }
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index 9efd014cea..c85a3222b3 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -16,7 +16,6 @@ syntax = "proto3";
 
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
-import "networking/v1alpha3/sidecar.proto";
 
 // $title: Traffic Routing
 // $description: Configuration affecting traffic routing.
@@ -177,11 +176,20 @@ message VirtualService {
   // matching an incoming request is used.
   repeated TCPRoute tcp = 4;
 
-  // The visibility setting associated with this VirtualService. Set to
-  // PRIVATE if this virtual service should not be exported, i.e. restrict
-  // the applicability of this virtual service to only workloads in the same
-  // namespace as the virtual service.
-  ConfigScope config_scope = 6;
+  // A list of namespaces to which this virtual service is exported. Exporting a
+  // virtual service allows it to used by sidecars and gateways defined in
+  // other namespaces. This feature provides a mechanism for service owners
+  // and mesh administrators to control the visibility of virtual services
+  // across namespace boundaries.
+  //
+  // If no namespaces are specified then the virtual service is exported to all
+  // namespaces by default.
+  //
+  // The value "." is reserved and defines an export to the same namespace that
+  // the virtual service is declared in, similarly the value "*" is reserved and
+  // defines an export to all namespaces.
+  //
+  repeated string export_to = 6;
 }
 
 // Destination indicates the network addressable service to which the
diff --git a/proto.lock b/proto.lock
index 8ec68701a8..ca542d4f75 100644
--- a/proto.lock
+++ b/proto.lock
@@ -958,11 +958,6 @@
                 "type": "ConfigSource",
                 "is_repeated": true
               },
-              {
-                "id": 31,
-                "name": "locality_lb_setting",
-                "type": "LocalityLoadBalancerSetting"
-              },
               {
                 "id": 23,
                 "name": "enable_sds_token_mount",
@@ -977,6 +972,34 @@
                 "id": 26,
                 "name": "trust_domain",
                 "type": "string"
+              },
+              {
+                "id": 31,
+                "name": "default_service_export_to",
+                "type": "string",
+                "is_repeated": true
+              },
+              {
+                "id": 32,
+                "name": "default_virtual_service_export_to",
+                "type": "string",
+                "is_repeated": true
+              },
+              {
+                "id": 33,
+                "name": "default_destination_rule_export_to",
+                "type": "string",
+                "is_repeated": true
+              },
+              {
+                "id": 34,
+                "name": "root_namespace",
+                "type": "string"
+              },
+              {
+                "id": 35,
+                "name": "locality_lb_setting",
+                "type": "LocalityLoadBalancerSetting"
               }
             ],
             "reserved_ids": [
@@ -2655,8 +2678,9 @@
               },
               {
                 "id": 4,
-                "name": "config_scope",
-                "type": "ConfigScope"
+                "name": "exportTo",
+                "type": "string",
+                "is_repeated": true
               }
             ]
           },
@@ -3410,8 +3434,9 @@
               },
               {
                 "id": 7,
-                "name": "config_scope",
-                "type": "ConfigScope"
+                "name": "export_to",
+                "type": "string",
+                "is_repeated": true
               }
             ],
             "messages": [
@@ -3467,19 +3492,6 @@
       "protopath": "networking:/:v1alpha3:/:sidecar.proto",
       "def": {
         "enums": [
-          {
-            "name": "ConfigScope",
-            "enum_fields": [
-              {
-                "name": "PUBLIC",
-                "integer": 0
-              },
-              {
-                "name": "PRIVATE",
-                "integer": 1
-              }
-            ]
-          },
           {
             "name": "CaptureMode",
             "enum_fields": [
@@ -3627,8 +3639,9 @@
               },
               {
                 "id": 6,
-                "name": "config_scope",
-                "type": "ConfigScope"
+                "name": "export_to",
+                "type": "string",
+                "is_repeated": true
               }
             ]
           },
diff --git a/python/istio_api/mesh/v1alpha1/config_pb2.py b/python/istio_api/mesh/v1alpha1/config_pb2.py
index 54e8726de4..b8d0290a1b 100644
--- a/python/istio_api/mesh/v1alpha1/config_pb2.py
+++ b/python/istio_api/mesh/v1alpha1/config_pb2.py
@@ -22,7 +22,7 @@
   name='mesh/v1alpha1/config.proto',
   package='istio.mesh.v1alpha1',
   syntax='proto3',
-  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xe5\x0c\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12-\n%sidecar_to_telemetry_session_affinity\x18\x1e \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12N\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncoding\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12V\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12M\n\x13locality_lb_setting\x18\x1f \x01(\x0b\x32\x30.istio.mesh.v1alpha1.LocalityLoadBalancerSetting\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x12\x1a\n\x12sds_use_k8s_sa_jwt\x18\x1d \x01(\x08\x12\x14\n\x0ctrust_domain\x18\x1a \x01(\t\x1a\xa7\x01\n\x15OutboundTrafficPolicy\x12H\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.Mode\"D\n\x04Mode\x12\x11\n\rREGISTRY_ONLY\x10\x00\x12\r\n\tALLOW_ANY\x10\x01\"\x04\x08\x02\x10\x02*\x14VIRTUAL_SERVICE_ONLY\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\"\xfa\x02\n\x1bLocalityLoadBalancerSetting\x12O\n\ndistribute\x18\x01 \x03(\x0b\x32;.istio.mesh.v1alpha1.LocalityLoadBalancerSetting.Distribute\x12K\n\x08\x66\x61ilover\x18\x02 \x03(\x0b\x32\x39.istio.mesh.v1alpha1.LocalityLoadBalancerSetting.Failover\x1a\x96\x01\n\nDistribute\x12\x0c\n\x04\x66rom\x18\x01 \x01(\t\x12O\n\x02to\x18\x02 \x03(\x0b\x32\x43.istio.mesh.v1alpha1.LocalityLoadBalancerSetting.Distribute.ToEntry\x1a)\n\x07ToEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\r:\x02\x38\x01\x1a$\n\x08\x46\x61ilover\x12\x0c\n\x04\x66rom\x18\x01 \x01(\t\x12\n\n\x02to\x18\x02 \x01(\tB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
+  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xf7\r\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12-\n%sidecar_to_telemetry_session_affinity\x18\x1e \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12N\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncoding\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12V\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x12\x1a\n\x12sds_use_k8s_sa_jwt\x18\x1d \x01(\x08\x12\x14\n\x0ctrust_domain\x18\x1a \x01(\t\x12!\n\x19\x64\x65\x66\x61ult_service_export_to\x18\x1f \x03(\t\x12)\n!default_virtual_service_export_to\x18  \x03(\t\x12*\n\"default_destination_rule_export_to\x18! \x03(\t\x12\x16\n\x0eroot_namespace\x18\" \x01(\t\x12M\n\x13locality_lb_setting\x18# \x01(\x0b\x32\x30.istio.mesh.v1alpha1.LocalityLoadBalancerSetting\x1a\xa7\x01\n\x15OutboundTrafficPolicy\x12H\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.Mode\"D\n\x04Mode\x12\x11\n\rREGISTRY_ONLY\x10\x00\x12\r\n\tALLOW_ANY\x10\x01\"\x04\x08\x02\x10\x02*\x14VIRTUAL_SERVICE_ONLY\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\"\xfa\x02\n\x1bLocalityLoadBalancerSetting\x12O\n\ndistribute\x18\x01 \x03(\x0b\x32;.istio.mesh.v1alpha1.LocalityLoadBalancerSetting.Distribute\x12K\n\x08\x66\x61ilover\x18\x02 \x03(\x0b\x32\x39.istio.mesh.v1alpha1.LocalityLoadBalancerSetting.Failover\x1a\x96\x01\n\nDistribute\x12\x0c\n\x04\x66rom\x18\x01 \x01(\t\x12O\n\x02to\x18\x02 \x03(\x0b\x32\x43.istio.mesh.v1alpha1.LocalityLoadBalancerSetting.Distribute.ToEntry\x1a)\n\x07ToEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\r:\x02\x38\x01\x1a$\n\x08\x46\x61ilover\x12\x0c\n\x04\x66rom\x18\x01 \x01(\t\x12\n\n\x02to\x18\x02 \x01(\tB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_destination__rule__pb2.DESCRIPTOR,])
 
@@ -45,8 +45,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1572,
-  serialized_end=1640,
+  serialized_start=1718,
+  serialized_end=1786,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE)
 
@@ -71,8 +71,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1642,
-  serialized_end=1699,
+  serialized_start=1788,
+  serialized_end=1845,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_INGRESSCONTROLLERMODE)
 
@@ -93,8 +93,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1701,
-  serialized_end=1739,
+  serialized_start=1847,
+  serialized_end=1885,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_AUTHPOLICY)
 
@@ -115,8 +115,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1741,
-  serialized_end=1780,
+  serialized_start=1887,
+  serialized_end=1926,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_ACCESSLOGENCODING)
 
@@ -148,8 +148,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1473,
-  serialized_end=1640,
+  serialized_start=1619,
+  serialized_end=1786,
 )
 
 _MESHCONFIG = _descriptor.Descriptor(
@@ -335,33 +335,61 @@
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='locality_lb_setting', full_name='istio.mesh.v1alpha1.MeshConfig.locality_lb_setting', index=25,
-      number=31, type=11, cpp_type=10, label=1,
-      has_default_value=False, default_value=None,
-      message_type=None, enum_type=None, containing_type=None,
-      is_extension=False, extension_scope=None,
-      options=None, file=DESCRIPTOR),
-    _descriptor.FieldDescriptor(
-      name='enable_sds_token_mount', full_name='istio.mesh.v1alpha1.MeshConfig.enable_sds_token_mount', index=26,
+      name='enable_sds_token_mount', full_name='istio.mesh.v1alpha1.MeshConfig.enable_sds_token_mount', index=25,
       number=23, type=8, cpp_type=7, label=1,
       has_default_value=False, default_value=False,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='sds_use_k8s_sa_jwt', full_name='istio.mesh.v1alpha1.MeshConfig.sds_use_k8s_sa_jwt', index=27,
+      name='sds_use_k8s_sa_jwt', full_name='istio.mesh.v1alpha1.MeshConfig.sds_use_k8s_sa_jwt', index=26,
       number=29, type=8, cpp_type=7, label=1,
       has_default_value=False, default_value=False,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='trust_domain', full_name='istio.mesh.v1alpha1.MeshConfig.trust_domain', index=28,
+      name='trust_domain', full_name='istio.mesh.v1alpha1.MeshConfig.trust_domain', index=27,
       number=26, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='default_service_export_to', full_name='istio.mesh.v1alpha1.MeshConfig.default_service_export_to', index=28,
+      number=31, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='default_virtual_service_export_to', full_name='istio.mesh.v1alpha1.MeshConfig.default_virtual_service_export_to', index=29,
+      number=32, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='default_destination_rule_export_to', full_name='istio.mesh.v1alpha1.MeshConfig.default_destination_rule_export_to', index=30,
+      number=33, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='root_namespace', full_name='istio.mesh.v1alpha1.MeshConfig.root_namespace', index=31,
+      number=34, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='locality_lb_setting', full_name='istio.mesh.v1alpha1.MeshConfig.locality_lb_setting', index=32,
+      number=35, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
   ],
   extensions=[
   ],
@@ -378,7 +406,7 @@
   oneofs=[
   ],
   serialized_start=155,
-  serialized_end=1792,
+  serialized_end=1938,
 )
 
 
@@ -415,8 +443,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1794,
-  serialized_end=1887,
+  serialized_start=1940,
+  serialized_end=2033,
 )
 
 
@@ -453,8 +481,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2189,
-  serialized_end=2230,
+  serialized_start=2335,
+  serialized_end=2376,
 )
 
 _LOCALITYLOADBALANCERSETTING_DISTRIBUTE = _descriptor.Descriptor(
@@ -490,8 +518,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2080,
-  serialized_end=2230,
+  serialized_start=2226,
+  serialized_end=2376,
 )
 
 _LOCALITYLOADBALANCERSETTING_FAILOVER = _descriptor.Descriptor(
@@ -527,8 +555,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2232,
-  serialized_end=2268,
+  serialized_start=2378,
+  serialized_end=2414,
 )
 
 _LOCALITYLOADBALANCERSETTING = _descriptor.Descriptor(
@@ -564,8 +592,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1890,
-  serialized_end=2268,
+  serialized_start=2036,
+  serialized_end=2414,
 )
 
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY.fields_by_name['mode'].enum_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE
diff --git a/python/istio_api/networking/v1alpha3/destination_rule_pb2.py b/python/istio_api/networking/v1alpha3/destination_rule_pb2.py
index 3a54fdf1f0..1d08e8242d 100644
--- a/python/istio_api/networking/v1alpha3/destination_rule_pb2.py
+++ b/python/istio_api/networking/v1alpha3/destination_rule_pb2.py
@@ -15,7 +15,6 @@
 
 from google.protobuf import duration_pb2 as google_dot_protobuf_dot_duration__pb2
 from networking.v1alpha3 import virtual_service_pb2 as networking_dot_v1alpha3_dot_virtual__service__pb2
-from networking.v1alpha3 import sidecar_pb2 as networking_dot_v1alpha3_dot_sidecar__pb2
 from gogoproto import gogo_pb2 as gogoproto_dot_gogo__pb2
 
 
@@ -23,9 +22,9 @@
   name='networking/v1alpha3/destination_rule.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n*networking/v1alpha3/destination_rule.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a)networking/v1alpha3/virtual_service.proto\x1a!networking/v1alpha3/sidecar.proto\x1a\x14gogoproto/gogo.proto\"\xd3\x01\n\x0f\x44\x65stinationRule\x12\x0c\n\x04host\x18\x01 \x01(\t\x12@\n\x0etraffic_policy\x18\x02 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x12\x32\n\x07subsets\x18\x03 \x03(\x0b\x32!.istio.networking.v1alpha3.Subset\x12<\n\x0c\x63onfig_scope\x18\x04 \x01(\x0e\x32&.istio.networking.v1alpha3.ConfigScope\"\xd7\x05\n\rTrafficPolicy\x12\x46\n\rload_balancer\x18\x01 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x02 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x03 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\x12W\n\x13port_level_settings\x18\x05 \x03(\x0b\x32:.istio.networking.v1alpha3.TrafficPolicy.PortTrafficPolicy\x1a\xdb\x02\n\x11PortTrafficPolicy\x12\x35\n\x04port\x18\x01 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\x12\x46\n\rload_balancer\x18\x02 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x03 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x04 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x05 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\"\xc6\x01\n\x06Subset\x12\x0c\n\x04name\x18\x01 \x01(\t\x12=\n\x06labels\x18\x02 \x03(\x0b\x32-.istio.networking.v1alpha3.Subset.LabelsEntry\x12@\n\x0etraffic_policy\x18\x03 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc3\x04\n\x14LoadBalancerSettings\x12J\n\x06simple\x18\x01 \x01(\x0e\x32\x38.istio.networking.v1alpha3.LoadBalancerSettings.SimpleLBH\x00\x12[\n\x0f\x63onsistent_hash\x18\x02 \x01(\x0b\x32@.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLBH\x00\x1a\xaa\x02\n\x10\x43onsistentHashLB\x12\x1a\n\x10http_header_name\x18\x01 \x01(\tH\x00\x12\x62\n\x0bhttp_cookie\x18\x02 \x01(\x0b\x32K.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLB.HTTPCookieH\x00\x12\x17\n\ruse_source_ip\x18\x03 \x01(\x08H\x00\x12\x19\n\x11minimum_ring_size\x18\x04 \x01(\x04\x1aV\n\nHTTPCookie\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04path\x18\x02 \x01(\t\x12,\n\x03ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x04\x98\xdf\x1f\x01\x42\n\n\x08hash_key\"H\n\x08SimpleLB\x12\x0f\n\x0bROUND_ROBIN\x10\x00\x12\x0e\n\nLEAST_CONN\x10\x01\x12\n\n\x06RANDOM\x10\x02\x12\x0f\n\x0bPASSTHROUGH\x10\x03\x42\x0b\n\tlb_policy\"\xf3\x04\n\x16\x43onnectionPoolSettings\x12J\n\x03tcp\x18\x01 \x01(\x0b\x32=.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings\x12L\n\x04http\x18\x02 \x01(\x0b\x32>.istio.networking.v1alpha3.ConnectionPoolSettings.HTTPSettings\x1a\xb3\x02\n\x0bTCPSettings\x12\x17\n\x0fmax_connections\x18\x01 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x03 \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x1at\n\x0cTcpKeepalive\x12\x0e\n\x06probes\x18\x01 \x01(\r\x12\'\n\x04time\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12+\n\x08interval\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x1a\x88\x01\n\x0cHTTPSettings\x12\"\n\x1ahttp1_max_pending_requests\x18\x01 \x01(\x05\x12\x1a\n\x12http2_max_requests\x18\x02 \x01(\x05\x12#\n\x1bmax_requests_per_connection\x18\x03 \x01(\x05\x12\x13\n\x0bmax_retries\x18\x04 \x01(\x05\"\xcc\x01\n\x10OutlierDetection\x12\x1a\n\x12\x63onsecutive_errors\x18\x01 \x01(\x05\x12+\n\x08interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x12\x62\x61se_ejection_time\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1c\n\x14max_ejection_percent\x18\x04 \x01(\x05\x12\x1a\n\x12min_health_percent\x18\x05 \x01(\x05\"\xff\x01\n\x0bTLSSettings\x12<\n\x04mode\x18\x01 \x01(\x0e\x32..istio.networking.v1alpha3.TLSSettings.TLSmode\x12\x1a\n\x12\x63lient_certificate\x18\x02 \x01(\t\x12\x13\n\x0bprivate_key\x18\x03 \x01(\t\x12\x17\n\x0f\x63\x61_certificates\x18\x04 \x01(\t\x12\x19\n\x11subject_alt_names\x18\x05 \x03(\t\x12\x0b\n\x03sni\x18\x06 \x01(\t\"@\n\x07TLSmode\x12\x0b\n\x07\x44ISABLE\x10\x00\x12\n\n\x06SIMPLE\x10\x01\x12\n\n\x06MUTUAL\x10\x02\x12\x10\n\x0cISTIO_MUTUAL\x10\x03\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n*networking/v1alpha3/destination_rule.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a)networking/v1alpha3/virtual_service.proto\x1a\x14gogoproto/gogo.proto\"\xa7\x01\n\x0f\x44\x65stinationRule\x12\x0c\n\x04host\x18\x01 \x01(\t\x12@\n\x0etraffic_policy\x18\x02 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x12\x32\n\x07subsets\x18\x03 \x03(\x0b\x32!.istio.networking.v1alpha3.Subset\x12\x10\n\x08\x65xportTo\x18\x04 \x03(\t\"\xd7\x05\n\rTrafficPolicy\x12\x46\n\rload_balancer\x18\x01 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x02 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x03 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\x12W\n\x13port_level_settings\x18\x05 \x03(\x0b\x32:.istio.networking.v1alpha3.TrafficPolicy.PortTrafficPolicy\x1a\xdb\x02\n\x11PortTrafficPolicy\x12\x35\n\x04port\x18\x01 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\x12\x46\n\rload_balancer\x18\x02 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x03 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x04 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x05 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\"\xc6\x01\n\x06Subset\x12\x0c\n\x04name\x18\x01 \x01(\t\x12=\n\x06labels\x18\x02 \x03(\x0b\x32-.istio.networking.v1alpha3.Subset.LabelsEntry\x12@\n\x0etraffic_policy\x18\x03 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc3\x04\n\x14LoadBalancerSettings\x12J\n\x06simple\x18\x01 \x01(\x0e\x32\x38.istio.networking.v1alpha3.LoadBalancerSettings.SimpleLBH\x00\x12[\n\x0f\x63onsistent_hash\x18\x02 \x01(\x0b\x32@.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLBH\x00\x1a\xaa\x02\n\x10\x43onsistentHashLB\x12\x1a\n\x10http_header_name\x18\x01 \x01(\tH\x00\x12\x62\n\x0bhttp_cookie\x18\x02 \x01(\x0b\x32K.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLB.HTTPCookieH\x00\x12\x17\n\ruse_source_ip\x18\x03 \x01(\x08H\x00\x12\x19\n\x11minimum_ring_size\x18\x04 \x01(\x04\x1aV\n\nHTTPCookie\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04path\x18\x02 \x01(\t\x12,\n\x03ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x04\x98\xdf\x1f\x01\x42\n\n\x08hash_key\"H\n\x08SimpleLB\x12\x0f\n\x0bROUND_ROBIN\x10\x00\x12\x0e\n\nLEAST_CONN\x10\x01\x12\n\n\x06RANDOM\x10\x02\x12\x0f\n\x0bPASSTHROUGH\x10\x03\x42\x0b\n\tlb_policy\"\xf3\x04\n\x16\x43onnectionPoolSettings\x12J\n\x03tcp\x18\x01 \x01(\x0b\x32=.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings\x12L\n\x04http\x18\x02 \x01(\x0b\x32>.istio.networking.v1alpha3.ConnectionPoolSettings.HTTPSettings\x1a\xb3\x02\n\x0bTCPSettings\x12\x17\n\x0fmax_connections\x18\x01 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x03 \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x1at\n\x0cTcpKeepalive\x12\x0e\n\x06probes\x18\x01 \x01(\r\x12\'\n\x04time\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12+\n\x08interval\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x1a\x88\x01\n\x0cHTTPSettings\x12\"\n\x1ahttp1_max_pending_requests\x18\x01 \x01(\x05\x12\x1a\n\x12http2_max_requests\x18\x02 \x01(\x05\x12#\n\x1bmax_requests_per_connection\x18\x03 \x01(\x05\x12\x13\n\x0bmax_retries\x18\x04 \x01(\x05\"\xcc\x01\n\x10OutlierDetection\x12\x1a\n\x12\x63onsecutive_errors\x18\x01 \x01(\x05\x12+\n\x08interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x12\x62\x61se_ejection_time\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1c\n\x14max_ejection_percent\x18\x04 \x01(\x05\x12\x1a\n\x12min_health_percent\x18\x05 \x01(\x05\"\xff\x01\n\x0bTLSSettings\x12<\n\x04mode\x18\x01 \x01(\x0e\x32..istio.networking.v1alpha3.TLSSettings.TLSmode\x12\x1a\n\x12\x63lient_certificate\x18\x02 \x01(\t\x12\x13\n\x0bprivate_key\x18\x03 \x01(\t\x12\x17\n\x0f\x63\x61_certificates\x18\x04 \x01(\t\x12\x19\n\x11subject_alt_names\x18\x05 \x03(\t\x12\x0b\n\x03sni\x18\x06 \x01(\t\"@\n\x07TLSmode\x12\x0b\n\x07\x44ISABLE\x10\x00\x12\n\n\x06SIMPLE\x10\x01\x12\n\n\x06MUTUAL\x10\x02\x12\x10\n\x0cISTIO_MUTUAL\x10\x03\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
   ,
-  dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_virtual__service__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_sidecar__pb2.DESCRIPTOR,gogoproto_dot_gogo__pb2.DESCRIPTOR,])
+  dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_virtual__service__pb2.DESCRIPTOR,gogoproto_dot_gogo__pb2.DESCRIPTOR,])
 
 
 
@@ -54,8 +53,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1845,
-  serialized_end=1917,
+  serialized_start=1766,
+  serialized_end=1838,
 )
 _sym_db.RegisterEnumDescriptor(_LOADBALANCERSETTINGS_SIMPLELB)
 
@@ -84,8 +83,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=2961,
-  serialized_end=3025,
+  serialized_start=2882,
+  serialized_end=2946,
 )
 _sym_db.RegisterEnumDescriptor(_TLSSETTINGS_TLSMODE)
 
@@ -119,9 +118,9 @@
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='config_scope', full_name='istio.networking.v1alpha3.DestinationRule.config_scope', index=3,
-      number=4, type=14, cpp_type=8, label=1,
-      has_default_value=False, default_value=0,
+      name='exportTo', full_name='istio.networking.v1alpha3.DestinationRule.exportTo', index=3,
+      number=4, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
@@ -137,8 +136,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=206,
-  serialized_end=417,
+  serialized_start=171,
+  serialized_end=338,
 )
 
 
@@ -196,8 +195,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=800,
-  serialized_end=1147,
+  serialized_start=721,
+  serialized_end=1068,
 )
 
 _TRAFFICPOLICY = _descriptor.Descriptor(
@@ -254,8 +253,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=420,
-  serialized_end=1147,
+  serialized_start=341,
+  serialized_end=1068,
 )
 
 
@@ -292,8 +291,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1303,
-  serialized_end=1348,
+  serialized_start=1224,
+  serialized_end=1269,
 )
 
 _SUBSET = _descriptor.Descriptor(
@@ -336,8 +335,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1150,
-  serialized_end=1348,
+  serialized_start=1071,
+  serialized_end=1269,
 )
 
 
@@ -381,8 +380,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1745,
-  serialized_end=1831,
+  serialized_start=1666,
+  serialized_end=1752,
 )
 
 _LOADBALANCERSETTINGS_CONSISTENTHASHLB = _descriptor.Descriptor(
@@ -435,8 +434,8 @@
       name='hash_key', full_name='istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLB.hash_key',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=1545,
-  serialized_end=1843,
+  serialized_start=1466,
+  serialized_end=1764,
 )
 
 _LOADBALANCERSETTINGS = _descriptor.Descriptor(
@@ -476,8 +475,8 @@
       name='lb_policy', full_name='istio.networking.v1alpha3.LoadBalancerSettings.lb_policy',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=1351,
-  serialized_end=1930,
+  serialized_start=1272,
+  serialized_end=1851,
 )
 
 
@@ -521,8 +520,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2305,
-  serialized_end=2421,
+  serialized_start=2226,
+  serialized_end=2342,
 )
 
 _CONNECTIONPOOLSETTINGS_TCPSETTINGS = _descriptor.Descriptor(
@@ -565,8 +564,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2114,
-  serialized_end=2421,
+  serialized_start=2035,
+  serialized_end=2342,
 )
 
 _CONNECTIONPOOLSETTINGS_HTTPSETTINGS = _descriptor.Descriptor(
@@ -616,8 +615,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2424,
-  serialized_end=2560,
+  serialized_start=2345,
+  serialized_end=2481,
 )
 
 _CONNECTIONPOOLSETTINGS = _descriptor.Descriptor(
@@ -653,8 +652,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1933,
-  serialized_end=2560,
+  serialized_start=1854,
+  serialized_end=2481,
 )
 
 
@@ -712,8 +711,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2563,
-  serialized_end=2767,
+  serialized_start=2484,
+  serialized_end=2688,
 )
 
 
@@ -779,13 +778,12 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2770,
-  serialized_end=3025,
+  serialized_start=2691,
+  serialized_end=2946,
 )
 
 _DESTINATIONRULE.fields_by_name['traffic_policy'].message_type = _TRAFFICPOLICY
 _DESTINATIONRULE.fields_by_name['subsets'].message_type = _SUBSET
-_DESTINATIONRULE.fields_by_name['config_scope'].enum_type = networking_dot_v1alpha3_dot_sidecar__pb2._CONFIGSCOPE
 _TRAFFICPOLICY_PORTTRAFFICPOLICY.fields_by_name['port'].message_type = networking_dot_v1alpha3_dot_virtual__service__pb2._PORTSELECTOR
 _TRAFFICPOLICY_PORTTRAFFICPOLICY.fields_by_name['load_balancer'].message_type = _LOADBALANCERSETTINGS
 _TRAFFICPOLICY_PORTTRAFFICPOLICY.fields_by_name['connection_pool'].message_type = _CONNECTIONPOOLSETTINGS
diff --git a/python/istio_api/networking/v1alpha3/service_entry_pb2.py b/python/istio_api/networking/v1alpha3/service_entry_pb2.py
index 0375749f9a..98a378aafd 100644
--- a/python/istio_api/networking/v1alpha3/service_entry_pb2.py
+++ b/python/istio_api/networking/v1alpha3/service_entry_pb2.py
@@ -14,16 +14,15 @@
 
 
 from networking.v1alpha3 import gateway_pb2 as networking_dot_v1alpha3_dot_gateway__pb2
-from networking.v1alpha3 import sidecar_pb2 as networking_dot_v1alpha3_dot_sidecar__pb2
 
 
 DESCRIPTOR = _descriptor.FileDescriptor(
   name='networking/v1alpha3/service_entry.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n\'networking/v1alpha3/service_entry.proto\x12\x19istio.networking.v1alpha3\x1a!networking/v1alpha3/gateway.proto\x1a!networking/v1alpha3/sidecar.proto\"\x96\x06\n\x0cServiceEntry\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12.\n\x05ports\x18\x03 \x03(\x0b\x32\x1f.istio.networking.v1alpha3.Port\x12\x42\n\x08location\x18\x04 \x01(\x0e\x32\x30.istio.networking.v1alpha3.ServiceEntry.Location\x12\x46\n\nresolution\x18\x05 \x01(\x0e\x32\x32.istio.networking.v1alpha3.ServiceEntry.Resolution\x12\x43\n\tendpoints\x18\x06 \x03(\x0b\x32\x30.istio.networking.v1alpha3.ServiceEntry.Endpoint\x12<\n\x0c\x63onfig_scope\x18\x07 \x01(\x0e\x32&.istio.networking.v1alpha3.ConfigScope\x1a\xc5\x02\n\x08\x45ndpoint\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12J\n\x05ports\x18\x02 \x03(\x0b\x32;.istio.networking.v1alpha3.ServiceEntry.Endpoint.PortsEntry\x12L\n\x06labels\x18\x03 \x03(\x0b\x32<.istio.networking.v1alpha3.ServiceEntry.Endpoint.LabelsEntry\x12\x0f\n\x07network\x18\x04 \x01(\t\x12\x10\n\x08locality\x18\x05 \x01(\t\x12\x0e\n\x06weight\x18\x06 \x01(\r\x1a,\n\nPortsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\r:\x02\x38\x01\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"0\n\x08Location\x12\x11\n\rMESH_EXTERNAL\x10\x00\x12\x11\n\rMESH_INTERNAL\x10\x01\"+\n\nResolution\x12\x08\n\x04NONE\x10\x00\x12\n\n\x06STATIC\x10\x01\x12\x07\n\x03\x44NS\x10\x02\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n\'networking/v1alpha3/service_entry.proto\x12\x19istio.networking.v1alpha3\x1a!networking/v1alpha3/gateway.proto\"\xeb\x05\n\x0cServiceEntry\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12.\n\x05ports\x18\x03 \x03(\x0b\x32\x1f.istio.networking.v1alpha3.Port\x12\x42\n\x08location\x18\x04 \x01(\x0e\x32\x30.istio.networking.v1alpha3.ServiceEntry.Location\x12\x46\n\nresolution\x18\x05 \x01(\x0e\x32\x32.istio.networking.v1alpha3.ServiceEntry.Resolution\x12\x43\n\tendpoints\x18\x06 \x03(\x0b\x32\x30.istio.networking.v1alpha3.ServiceEntry.Endpoint\x12\x11\n\texport_to\x18\x07 \x03(\t\x1a\xc5\x02\n\x08\x45ndpoint\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12J\n\x05ports\x18\x02 \x03(\x0b\x32;.istio.networking.v1alpha3.ServiceEntry.Endpoint.PortsEntry\x12L\n\x06labels\x18\x03 \x03(\x0b\x32<.istio.networking.v1alpha3.ServiceEntry.Endpoint.LabelsEntry\x12\x0f\n\x07network\x18\x04 \x01(\t\x12\x10\n\x08locality\x18\x05 \x01(\t\x12\x0e\n\x06weight\x18\x06 \x01(\r\x1a,\n\nPortsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\r:\x02\x38\x01\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"0\n\x08Location\x12\x11\n\rMESH_EXTERNAL\x10\x00\x12\x11\n\rMESH_INTERNAL\x10\x01\"+\n\nResolution\x12\x08\n\x04NONE\x10\x00\x12\n\n\x06STATIC\x10\x01\x12\x07\n\x03\x44NS\x10\x02\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
   ,
-  dependencies=[networking_dot_v1alpha3_dot_gateway__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_sidecar__pb2.DESCRIPTOR,])
+  dependencies=[networking_dot_v1alpha3_dot_gateway__pb2.DESCRIPTOR,])
 
 
 
@@ -44,8 +43,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=838,
-  serialized_end=886,
+  serialized_start=760,
+  serialized_end=808,
 )
 _sym_db.RegisterEnumDescriptor(_SERVICEENTRY_LOCATION)
 
@@ -70,8 +69,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=888,
-  serialized_end=931,
+  serialized_start=810,
+  serialized_end=853,
 )
 _sym_db.RegisterEnumDescriptor(_SERVICEENTRY_RESOLUTION)
 
@@ -109,8 +108,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=745,
-  serialized_end=789,
+  serialized_start=667,
+  serialized_end=711,
 )
 
 _SERVICEENTRY_ENDPOINT_LABELSENTRY = _descriptor.Descriptor(
@@ -146,8 +145,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=791,
-  serialized_end=836,
+  serialized_start=713,
+  serialized_end=758,
 )
 
 _SERVICEENTRY_ENDPOINT = _descriptor.Descriptor(
@@ -211,8 +210,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=511,
-  serialized_end=836,
+  serialized_start=433,
+  serialized_end=758,
 )
 
 _SERVICEENTRY = _descriptor.Descriptor(
@@ -265,9 +264,9 @@
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='config_scope', full_name='istio.networking.v1alpha3.ServiceEntry.config_scope', index=6,
-      number=7, type=14, cpp_type=8, label=1,
-      has_default_value=False, default_value=0,
+      name='export_to', full_name='istio.networking.v1alpha3.ServiceEntry.export_to', index=6,
+      number=7, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
@@ -285,8 +284,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=141,
-  serialized_end=931,
+  serialized_start=106,
+  serialized_end=853,
 )
 
 _SERVICEENTRY_ENDPOINT_PORTSENTRY.containing_type = _SERVICEENTRY_ENDPOINT
@@ -298,7 +297,6 @@
 _SERVICEENTRY.fields_by_name['location'].enum_type = _SERVICEENTRY_LOCATION
 _SERVICEENTRY.fields_by_name['resolution'].enum_type = _SERVICEENTRY_RESOLUTION
 _SERVICEENTRY.fields_by_name['endpoints'].message_type = _SERVICEENTRY_ENDPOINT
-_SERVICEENTRY.fields_by_name['config_scope'].enum_type = networking_dot_v1alpha3_dot_sidecar__pb2._CONFIGSCOPE
 _SERVICEENTRY_LOCATION.containing_type = _SERVICEENTRY
 _SERVICEENTRY_RESOLUTION.containing_type = _SERVICEENTRY
 DESCRIPTOR.message_types_by_name['ServiceEntry'] = _SERVICEENTRY
diff --git a/python/istio_api/networking/v1alpha3/sidecar_pb2.py b/python/istio_api/networking/v1alpha3/sidecar_pb2.py
index 33b4779367..7d6f2ae801 100644
--- a/python/istio_api/networking/v1alpha3/sidecar_pb2.py
+++ b/python/istio_api/networking/v1alpha3/sidecar_pb2.py
@@ -21,33 +21,10 @@
   name='networking/v1alpha3/sidecar.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n!networking/v1alpha3/sidecar.proto\x12\x19istio.networking.v1alpha3\x1a!networking/v1alpha3/gateway.proto\"\xd3\x01\n\x07Sidecar\x12\x46\n\x11workload_selector\x18\x01 \x01(\x0b\x32+.istio.networking.v1alpha3.WorkloadSelector\x12@\n\x07ingress\x18\x02 \x03(\x0b\x32/.istio.networking.v1alpha3.IstioIngressListener\x12>\n\x06\x65gress\x18\x03 \x03(\x0b\x32..istio.networking.v1alpha3.IstioEgressListener\"\xab\x01\n\x14IstioIngressListener\x12-\n\x04port\x18\x01 \x01(\x0b\x32\x1f.istio.networking.v1alpha3.Port\x12\x0c\n\x04\x62ind\x18\x02 \x01(\t\x12<\n\x0c\x63\x61pture_mode\x18\x03 \x01(\x0e\x32&.istio.networking.v1alpha3.CaptureMode\x12\x18\n\x10\x64\x65\x66\x61ult_endpoint\x18\x04 \x01(\t\"\x9f\x01\n\x13IstioEgressListener\x12-\n\x04port\x18\x01 \x01(\x0b\x32\x1f.istio.networking.v1alpha3.Port\x12\x0c\n\x04\x62ind\x18\x02 \x01(\t\x12<\n\x0c\x63\x61pture_mode\x18\x03 \x01(\x0e\x32&.istio.networking.v1alpha3.CaptureMode\x12\r\n\x05hosts\x18\x04 \x03(\t\"\x8a\x01\n\x10WorkloadSelector\x12G\n\x06labels\x18\x01 \x03(\x0b\x32\x37.istio.networking.v1alpha3.WorkloadSelector.LabelsEntry\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01*&\n\x0b\x43onfigScope\x12\n\n\x06PUBLIC\x10\x00\x12\x0b\n\x07PRIVATE\x10\x01*2\n\x0b\x43\x61ptureMode\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x00\x12\x0c\n\x08IPTABLES\x10\x01\x12\x08\n\x04NONE\x10\x02\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n!networking/v1alpha3/sidecar.proto\x12\x19istio.networking.v1alpha3\x1a!networking/v1alpha3/gateway.proto\"\xd3\x01\n\x07Sidecar\x12\x46\n\x11workload_selector\x18\x01 \x01(\x0b\x32+.istio.networking.v1alpha3.WorkloadSelector\x12@\n\x07ingress\x18\x02 \x03(\x0b\x32/.istio.networking.v1alpha3.IstioIngressListener\x12>\n\x06\x65gress\x18\x03 \x03(\x0b\x32..istio.networking.v1alpha3.IstioEgressListener\"\xab\x01\n\x14IstioIngressListener\x12-\n\x04port\x18\x01 \x01(\x0b\x32\x1f.istio.networking.v1alpha3.Port\x12\x0c\n\x04\x62ind\x18\x02 \x01(\t\x12<\n\x0c\x63\x61pture_mode\x18\x03 \x01(\x0e\x32&.istio.networking.v1alpha3.CaptureMode\x12\x18\n\x10\x64\x65\x66\x61ult_endpoint\x18\x04 \x01(\t\"\x9f\x01\n\x13IstioEgressListener\x12-\n\x04port\x18\x01 \x01(\x0b\x32\x1f.istio.networking.v1alpha3.Port\x12\x0c\n\x04\x62ind\x18\x02 \x01(\t\x12<\n\x0c\x63\x61pture_mode\x18\x03 \x01(\x0e\x32&.istio.networking.v1alpha3.CaptureMode\x12\r\n\x05hosts\x18\x04 \x03(\t\"\x8a\x01\n\x10WorkloadSelector\x12G\n\x06labels\x18\x01 \x03(\x0b\x32\x37.istio.networking.v1alpha3.WorkloadSelector.LabelsEntry\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01*2\n\x0b\x43\x61ptureMode\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x00\x12\x0c\n\x08IPTABLES\x10\x01\x12\x08\n\x04NONE\x10\x02\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
   ,
   dependencies=[networking_dot_v1alpha3_dot_gateway__pb2.DESCRIPTOR,])
 
-_CONFIGSCOPE = _descriptor.EnumDescriptor(
-  name='ConfigScope',
-  full_name='istio.networking.v1alpha3.ConfigScope',
-  filename=None,
-  file=DESCRIPTOR,
-  values=[
-    _descriptor.EnumValueDescriptor(
-      name='PUBLIC', index=0, number=0,
-      options=None,
-      type=None),
-    _descriptor.EnumValueDescriptor(
-      name='PRIVATE', index=1, number=1,
-      options=None,
-      type=None),
-  ],
-  containing_type=None,
-  options=None,
-  serialized_start=790,
-  serialized_end=828,
-)
-_sym_db.RegisterEnumDescriptor(_CONFIGSCOPE)
-
-ConfigScope = enum_type_wrapper.EnumTypeWrapper(_CONFIGSCOPE)
 _CAPTUREMODE = _descriptor.EnumDescriptor(
   name='CaptureMode',
   full_name='istio.networking.v1alpha3.CaptureMode',
@@ -69,14 +46,12 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=830,
-  serialized_end=880,
+  serialized_start=790,
+  serialized_end=840,
 )
 _sym_db.RegisterEnumDescriptor(_CAPTUREMODE)
 
 CaptureMode = enum_type_wrapper.EnumTypeWrapper(_CAPTUREMODE)
-PUBLIC = 0
-PRIVATE = 1
 DEFAULT = 0
 IPTABLES = 1
 NONE = 2
@@ -312,7 +287,6 @@
 DESCRIPTOR.message_types_by_name['IstioIngressListener'] = _ISTIOINGRESSLISTENER
 DESCRIPTOR.message_types_by_name['IstioEgressListener'] = _ISTIOEGRESSLISTENER
 DESCRIPTOR.message_types_by_name['WorkloadSelector'] = _WORKLOADSELECTOR
-DESCRIPTOR.enum_types_by_name['ConfigScope'] = _CONFIGSCOPE
 DESCRIPTOR.enum_types_by_name['CaptureMode'] = _CAPTUREMODE
 _sym_db.RegisterFileDescriptor(DESCRIPTOR)
 
diff --git a/python/istio_api/networking/v1alpha3/virtual_service_pb2.py b/python/istio_api/networking/v1alpha3/virtual_service_pb2.py
index 4bff1527b2..d23e70d230 100644
--- a/python/istio_api/networking/v1alpha3/virtual_service_pb2.py
+++ b/python/istio_api/networking/v1alpha3/virtual_service_pb2.py
@@ -15,16 +15,15 @@
 
 from google.protobuf import duration_pb2 as google_dot_protobuf_dot_duration__pb2
 from google.protobuf import wrappers_pb2 as google_dot_protobuf_dot_wrappers__pb2
-from networking.v1alpha3 import sidecar_pb2 as networking_dot_v1alpha3_dot_sidecar__pb2
 
 
 DESCRIPTOR = _descriptor.FileDescriptor(
   name='networking/v1alpha3/virtual_service.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n)networking/v1alpha3/virtual_service.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a!networking/v1alpha3/sidecar.proto\"\x87\x02\n\x0eVirtualService\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x10\n\x08gateways\x18\x02 \x03(\t\x12\x32\n\x04http\x18\x03 \x03(\x0b\x32$.istio.networking.v1alpha3.HTTPRoute\x12\x30\n\x03tls\x18\x05 \x03(\x0b\x32#.istio.networking.v1alpha3.TLSRoute\x12\x30\n\x03tcp\x18\x04 \x03(\x0b\x32#.istio.networking.v1alpha3.TCPRoute\x12<\n\x0c\x63onfig_scope\x18\x06 \x01(\x0e\x32&.istio.networking.v1alpha3.ConfigScope\"b\n\x0b\x44\x65stination\x12\x0c\n\x04host\x18\x01 \x01(\t\x12\x0e\n\x06subset\x18\x02 \x01(\t\x12\x35\n\x04port\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\"\xf9\x08\n\tHTTPRoute\x12:\n\x05match\x18\x01 \x03(\x0b\x32+.istio.networking.v1alpha3.HTTPMatchRequest\x12>\n\x05route\x18\x02 \x03(\x0b\x32/.istio.networking.v1alpha3.HTTPRouteDestination\x12\x39\n\x08redirect\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.HTTPRedirect\x12\x37\n\x07rewrite\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.HTTPRewrite\x12\x19\n\x11websocket_upgrade\x18\x05 \x01(\x08\x12*\n\x07timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x07retries\x18\x07 \x01(\x0b\x32$.istio.networking.v1alpha3.HTTPRetry\x12<\n\x05\x66\x61ult\x18\x08 \x01(\x0b\x32-.istio.networking.v1alpha3.HTTPFaultInjection\x12\x36\n\x06mirror\x18\t \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12:\n\x0b\x63ors_policy\x18\n \x01(\x0b\x32%.istio.networking.v1alpha3.CorsPolicy\x12S\n\x0e\x61ppend_headers\x18\x0b \x03(\x0b\x32\x37.istio.networking.v1alpha3.HTTPRoute.AppendHeadersEntryB\x02\x18\x01\x12#\n\x17remove_response_headers\x18\x0c \x03(\tB\x02\x18\x01\x12\x64\n\x17\x61ppend_response_headers\x18\r \x03(\x0b\x32?.istio.networking.v1alpha3.HTTPRoute.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x0e \x03(\tB\x02\x18\x01\x12\x62\n\x16\x61ppend_request_headers\x18\x0f \x03(\x0b\x32>.istio.networking.v1alpha3.HTTPRoute.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x10 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a\x34\n\x12\x41ppendHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xa9\x03\n\x07Headers\x12\x44\n\x07request\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x12\x45\n\x08response\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x1a\x90\x02\n\x10HeaderOperations\x12I\n\x03set\x18\x01 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.SetEntry\x12I\n\x03\x61\x64\x64\x18\x02 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.AddEntry\x12\x0e\n\x06remove\x18\x03 \x03(\t\x1a*\n\x08SetEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a*\n\x08\x41\x64\x64\x45ntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x84\x01\n\x08TLSRoute\x12<\n\x05match\x18\x01 \x03(\x0b\x32-.istio.networking.v1alpha3.TLSMatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\x83\x01\n\x08TCPRoute\x12;\n\x05match\x18\x01 \x03(\x0b\x32,.istio.networking.v1alpha3.L4MatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\xc0\x04\n\x10HTTPMatchRequest\x12\x33\n\x03uri\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06scheme\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06method\x18\x03 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x39\n\tauthority\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12I\n\x07headers\x18\x05 \x03(\x0b\x32\x38.istio.networking.v1alpha3.HTTPMatchRequest.HeadersEntry\x12\x0c\n\x04port\x18\x06 \x01(\r\x12T\n\rsource_labels\x18\x07 \x03(\x0b\x32=.istio.networking.v1alpha3.HTTPMatchRequest.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x08 \x03(\t\x1aV\n\x0cHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x35\n\x05value\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch:\x02\x38\x01\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xbc\x04\n\x14HTTPRouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\x12#\n\x17remove_response_headers\x18\x03 \x03(\tB\x02\x18\x01\x12o\n\x17\x61ppend_response_headers\x18\x04 \x03(\x0b\x32J.istio.networking.v1alpha3.HTTPRouteDestination.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x05 \x03(\tB\x02\x18\x01\x12m\n\x16\x61ppend_request_headers\x18\x06 \x03(\x0b\x32I.istio.networking.v1alpha3.HTTPRouteDestination.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x07 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"_\n\x10RouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\"\xf3\x01\n\x11L4MatchAttributes\x12\x1b\n\x13\x64\x65stination_subnets\x18\x01 \x03(\t\x12\x0c\n\x04port\x18\x02 \x01(\r\x12\x15\n\rsource_subnet\x18\x03 \x01(\t\x12U\n\rsource_labels\x18\x04 \x03(\x0b\x32>.istio.networking.v1alpha3.L4MatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x05 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x88\x02\n\x12TLSMatchAttributes\x12\x11\n\tsni_hosts\x18\x01 \x03(\t\x12\x1b\n\x13\x64\x65stination_subnets\x18\x02 \x03(\t\x12\x0c\n\x04port\x18\x03 \x01(\r\x12\x15\n\rsource_subnet\x18\x04 \x01(\t\x12V\n\rsource_labels\x18\x05 \x03(\x0b\x32?.istio.networking.v1alpha3.TLSMatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x06 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\".\n\x0cHTTPRedirect\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"-\n\x0bHTTPRewrite\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"O\n\x0bStringMatch\x12\x0f\n\x05\x65xact\x18\x01 \x01(\tH\x00\x12\x10\n\x06prefix\x18\x02 \x01(\tH\x00\x12\x0f\n\x05regex\x18\x03 \x01(\tH\x00\x42\x0c\n\nmatch_type\"c\n\tHTTPRetry\x12\x10\n\x08\x61ttempts\x18\x01 \x01(\x05\x12\x32\n\x0fper_try_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x10\n\x08retry_on\x18\x03 \x01(\t\"\xcb\x01\n\nCorsPolicy\x12\x14\n\x0c\x61llow_origin\x18\x01 \x03(\t\x12\x15\n\rallow_methods\x18\x02 \x03(\t\x12\x15\n\rallow_headers\x18\x03 \x03(\t\x12\x16\n\x0e\x65xpose_headers\x18\x04 \x03(\t\x12*\n\x07max_age\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x11\x61llow_credentials\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.BoolValue\"\x9a\x04\n\x12HTTPFaultInjection\x12\x42\n\x05\x64\x65lay\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Delay\x12\x42\n\x05\x61\x62ort\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Abort\x1a\xd1\x01\n\x05\x44\x65lay\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x30\n\x0b\x66ixed_delay\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\x11\x65xponential_delay\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x11\n\x0fhttp_delay_type\x1a\xa7\x01\n\x05\x41\x62ort\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x15\n\x0bhttp_status\x18\x02 \x01(\x05H\x00\x12\x15\n\x0bgrpc_status\x18\x03 \x01(\tH\x00\x12\x15\n\x0bhttp2_error\x18\x04 \x01(\tH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x0c\n\nerror_type\"8\n\x0cPortSelector\x12\x10\n\x06number\x18\x01 \x01(\rH\x00\x12\x0e\n\x04name\x18\x02 \x01(\tH\x00\x42\x06\n\x04port\"\x18\n\x07Percent\x12\r\n\x05value\x18\x01 \x01(\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n)networking/v1alpha3/virtual_service.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\"\xdc\x01\n\x0eVirtualService\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x10\n\x08gateways\x18\x02 \x03(\t\x12\x32\n\x04http\x18\x03 \x03(\x0b\x32$.istio.networking.v1alpha3.HTTPRoute\x12\x30\n\x03tls\x18\x05 \x03(\x0b\x32#.istio.networking.v1alpha3.TLSRoute\x12\x30\n\x03tcp\x18\x04 \x03(\x0b\x32#.istio.networking.v1alpha3.TCPRoute\x12\x11\n\texport_to\x18\x06 \x03(\t\"b\n\x0b\x44\x65stination\x12\x0c\n\x04host\x18\x01 \x01(\t\x12\x0e\n\x06subset\x18\x02 \x01(\t\x12\x35\n\x04port\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\"\xf9\x08\n\tHTTPRoute\x12:\n\x05match\x18\x01 \x03(\x0b\x32+.istio.networking.v1alpha3.HTTPMatchRequest\x12>\n\x05route\x18\x02 \x03(\x0b\x32/.istio.networking.v1alpha3.HTTPRouteDestination\x12\x39\n\x08redirect\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.HTTPRedirect\x12\x37\n\x07rewrite\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.HTTPRewrite\x12\x19\n\x11websocket_upgrade\x18\x05 \x01(\x08\x12*\n\x07timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x07retries\x18\x07 \x01(\x0b\x32$.istio.networking.v1alpha3.HTTPRetry\x12<\n\x05\x66\x61ult\x18\x08 \x01(\x0b\x32-.istio.networking.v1alpha3.HTTPFaultInjection\x12\x36\n\x06mirror\x18\t \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12:\n\x0b\x63ors_policy\x18\n \x01(\x0b\x32%.istio.networking.v1alpha3.CorsPolicy\x12S\n\x0e\x61ppend_headers\x18\x0b \x03(\x0b\x32\x37.istio.networking.v1alpha3.HTTPRoute.AppendHeadersEntryB\x02\x18\x01\x12#\n\x17remove_response_headers\x18\x0c \x03(\tB\x02\x18\x01\x12\x64\n\x17\x61ppend_response_headers\x18\r \x03(\x0b\x32?.istio.networking.v1alpha3.HTTPRoute.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x0e \x03(\tB\x02\x18\x01\x12\x62\n\x16\x61ppend_request_headers\x18\x0f \x03(\x0b\x32>.istio.networking.v1alpha3.HTTPRoute.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x10 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a\x34\n\x12\x41ppendHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xa9\x03\n\x07Headers\x12\x44\n\x07request\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x12\x45\n\x08response\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x1a\x90\x02\n\x10HeaderOperations\x12I\n\x03set\x18\x01 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.SetEntry\x12I\n\x03\x61\x64\x64\x18\x02 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.AddEntry\x12\x0e\n\x06remove\x18\x03 \x03(\t\x1a*\n\x08SetEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a*\n\x08\x41\x64\x64\x45ntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x84\x01\n\x08TLSRoute\x12<\n\x05match\x18\x01 \x03(\x0b\x32-.istio.networking.v1alpha3.TLSMatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\x83\x01\n\x08TCPRoute\x12;\n\x05match\x18\x01 \x03(\x0b\x32,.istio.networking.v1alpha3.L4MatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\xc0\x04\n\x10HTTPMatchRequest\x12\x33\n\x03uri\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06scheme\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06method\x18\x03 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x39\n\tauthority\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12I\n\x07headers\x18\x05 \x03(\x0b\x32\x38.istio.networking.v1alpha3.HTTPMatchRequest.HeadersEntry\x12\x0c\n\x04port\x18\x06 \x01(\r\x12T\n\rsource_labels\x18\x07 \x03(\x0b\x32=.istio.networking.v1alpha3.HTTPMatchRequest.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x08 \x03(\t\x1aV\n\x0cHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x35\n\x05value\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch:\x02\x38\x01\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xbc\x04\n\x14HTTPRouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\x12#\n\x17remove_response_headers\x18\x03 \x03(\tB\x02\x18\x01\x12o\n\x17\x61ppend_response_headers\x18\x04 \x03(\x0b\x32J.istio.networking.v1alpha3.HTTPRouteDestination.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x05 \x03(\tB\x02\x18\x01\x12m\n\x16\x61ppend_request_headers\x18\x06 \x03(\x0b\x32I.istio.networking.v1alpha3.HTTPRouteDestination.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x07 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"_\n\x10RouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\"\xf3\x01\n\x11L4MatchAttributes\x12\x1b\n\x13\x64\x65stination_subnets\x18\x01 \x03(\t\x12\x0c\n\x04port\x18\x02 \x01(\r\x12\x15\n\rsource_subnet\x18\x03 \x01(\t\x12U\n\rsource_labels\x18\x04 \x03(\x0b\x32>.istio.networking.v1alpha3.L4MatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x05 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x88\x02\n\x12TLSMatchAttributes\x12\x11\n\tsni_hosts\x18\x01 \x03(\t\x12\x1b\n\x13\x64\x65stination_subnets\x18\x02 \x03(\t\x12\x0c\n\x04port\x18\x03 \x01(\r\x12\x15\n\rsource_subnet\x18\x04 \x01(\t\x12V\n\rsource_labels\x18\x05 \x03(\x0b\x32?.istio.networking.v1alpha3.TLSMatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x06 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\".\n\x0cHTTPRedirect\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"-\n\x0bHTTPRewrite\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"O\n\x0bStringMatch\x12\x0f\n\x05\x65xact\x18\x01 \x01(\tH\x00\x12\x10\n\x06prefix\x18\x02 \x01(\tH\x00\x12\x0f\n\x05regex\x18\x03 \x01(\tH\x00\x42\x0c\n\nmatch_type\"c\n\tHTTPRetry\x12\x10\n\x08\x61ttempts\x18\x01 \x01(\x05\x12\x32\n\x0fper_try_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x10\n\x08retry_on\x18\x03 \x01(\t\"\xcb\x01\n\nCorsPolicy\x12\x14\n\x0c\x61llow_origin\x18\x01 \x03(\t\x12\x15\n\rallow_methods\x18\x02 \x03(\t\x12\x15\n\rallow_headers\x18\x03 \x03(\t\x12\x16\n\x0e\x65xpose_headers\x18\x04 \x03(\t\x12*\n\x07max_age\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x11\x61llow_credentials\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.BoolValue\"\x9a\x04\n\x12HTTPFaultInjection\x12\x42\n\x05\x64\x65lay\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Delay\x12\x42\n\x05\x61\x62ort\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Abort\x1a\xd1\x01\n\x05\x44\x65lay\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x30\n\x0b\x66ixed_delay\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\x11\x65xponential_delay\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x11\n\x0fhttp_delay_type\x1a\xa7\x01\n\x05\x41\x62ort\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x15\n\x0bhttp_status\x18\x02 \x01(\x05H\x00\x12\x15\n\x0bgrpc_status\x18\x03 \x01(\tH\x00\x12\x15\n\x0bhttp2_error\x18\x04 \x01(\tH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x0c\n\nerror_type\"8\n\x0cPortSelector\x12\x10\n\x06number\x18\x01 \x01(\rH\x00\x12\x0e\n\x04name\x18\x02 \x01(\tH\x00\x42\x06\n\x04port\"\x18\n\x07Percent\x12\r\n\x05value\x18\x01 \x01(\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
   ,
-  dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,google_dot_protobuf_dot_wrappers__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_sidecar__pb2.DESCRIPTOR,])
+  dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,google_dot_protobuf_dot_wrappers__pb2.DESCRIPTOR,])
 
 
 
@@ -72,9 +71,9 @@
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='config_scope', full_name='istio.networking.v1alpha3.VirtualService.config_scope', index=5,
-      number=6, type=14, cpp_type=8, label=1,
-      has_default_value=False, default_value=0,
+      name='export_to', full_name='istio.networking.v1alpha3.VirtualService.export_to', index=5,
+      number=6, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
@@ -90,8 +89,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=172,
-  serialized_end=435,
+  serialized_start=137,
+  serialized_end=357,
 )
 
 
@@ -135,8 +134,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=437,
-  serialized_end=535,
+  serialized_start=359,
+  serialized_end=457,
 )
 
 
@@ -173,8 +172,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1508,
-  serialized_end=1560,
+  serialized_start=1430,
+  serialized_end=1482,
 )
 
 _HTTPROUTE_APPENDRESPONSEHEADERSENTRY = _descriptor.Descriptor(
@@ -210,8 +209,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1562,
-  serialized_end=1622,
+  serialized_start=1484,
+  serialized_end=1544,
 )
 
 _HTTPROUTE_APPENDREQUESTHEADERSENTRY = _descriptor.Descriptor(
@@ -247,8 +246,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1624,
-  serialized_end=1683,
+  serialized_start=1546,
+  serialized_end=1605,
 )
 
 _HTTPROUTE = _descriptor.Descriptor(
@@ -382,8 +381,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=538,
-  serialized_end=1683,
+  serialized_start=460,
+  serialized_end=1605,
 )
 
 
@@ -420,8 +419,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2025,
-  serialized_end=2067,
+  serialized_start=1947,
+  serialized_end=1989,
 )
 
 _HEADERS_HEADEROPERATIONS_ADDENTRY = _descriptor.Descriptor(
@@ -457,8 +456,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2069,
-  serialized_end=2111,
+  serialized_start=1991,
+  serialized_end=2033,
 )
 
 _HEADERS_HEADEROPERATIONS = _descriptor.Descriptor(
@@ -501,8 +500,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1839,
-  serialized_end=2111,
+  serialized_start=1761,
+  serialized_end=2033,
 )
 
 _HEADERS = _descriptor.Descriptor(
@@ -538,8 +537,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1686,
-  serialized_end=2111,
+  serialized_start=1608,
+  serialized_end=2033,
 )
 
 
@@ -576,8 +575,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2114,
-  serialized_end=2246,
+  serialized_start=2036,
+  serialized_end=2168,
 )
 
 
@@ -614,8 +613,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2249,
-  serialized_end=2380,
+  serialized_start=2171,
+  serialized_end=2302,
 )
 
 
@@ -652,8 +651,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2820,
-  serialized_end=2906,
+  serialized_start=2742,
+  serialized_end=2828,
 )
 
 _HTTPMATCHREQUEST_SOURCELABELSENTRY = _descriptor.Descriptor(
@@ -689,8 +688,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2908,
-  serialized_end=2959,
+  serialized_start=2830,
+  serialized_end=2881,
 )
 
 _HTTPMATCHREQUEST = _descriptor.Descriptor(
@@ -768,8 +767,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2383,
-  serialized_end=2959,
+  serialized_start=2305,
+  serialized_end=2881,
 )
 
 
@@ -806,8 +805,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1562,
-  serialized_end=1622,
+  serialized_start=1484,
+  serialized_end=1544,
 )
 
 _HTTPROUTEDESTINATION_APPENDREQUESTHEADERSENTRY = _descriptor.Descriptor(
@@ -843,8 +842,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1624,
-  serialized_end=1683,
+  serialized_start=1546,
+  serialized_end=1605,
 )
 
 _HTTPROUTEDESTINATION = _descriptor.Descriptor(
@@ -915,8 +914,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2962,
-  serialized_end=3534,
+  serialized_start=2884,
+  serialized_end=3456,
 )
 
 
@@ -953,8 +952,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3536,
-  serialized_end=3631,
+  serialized_start=3458,
+  serialized_end=3553,
 )
 
 
@@ -991,8 +990,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2908,
-  serialized_end=2959,
+  serialized_start=2830,
+  serialized_end=2881,
 )
 
 _L4MATCHATTRIBUTES = _descriptor.Descriptor(
@@ -1049,8 +1048,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3634,
-  serialized_end=3877,
+  serialized_start=3556,
+  serialized_end=3799,
 )
 
 
@@ -1087,8 +1086,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2908,
-  serialized_end=2959,
+  serialized_start=2830,
+  serialized_end=2881,
 )
 
 _TLSMATCHATTRIBUTES = _descriptor.Descriptor(
@@ -1152,8 +1151,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3880,
-  serialized_end=4144,
+  serialized_start=3802,
+  serialized_end=4066,
 )
 
 
@@ -1190,8 +1189,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4146,
-  serialized_end=4192,
+  serialized_start=4068,
+  serialized_end=4114,
 )
 
 
@@ -1228,8 +1227,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4194,
-  serialized_end=4239,
+  serialized_start=4116,
+  serialized_end=4161,
 )
 
 
@@ -1276,8 +1275,8 @@
       name='match_type', full_name='istio.networking.v1alpha3.StringMatch.match_type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=4241,
-  serialized_end=4320,
+  serialized_start=4163,
+  serialized_end=4242,
 )
 
 
@@ -1321,8 +1320,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4322,
-  serialized_end=4421,
+  serialized_start=4244,
+  serialized_end=4343,
 )
 
 
@@ -1387,8 +1386,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4424,
-  serialized_end=4627,
+  serialized_start=4346,
+  serialized_end=4549,
 )
 
 
@@ -1442,8 +1441,8 @@
       name='http_delay_type', full_name='istio.networking.v1alpha3.HTTPFaultInjection.Delay.http_delay_type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=4789,
-  serialized_end=4998,
+  serialized_start=4711,
+  serialized_end=4920,
 )
 
 _HTTPFAULTINJECTION_ABORT = _descriptor.Descriptor(
@@ -1503,8 +1502,8 @@
       name='error_type', full_name='istio.networking.v1alpha3.HTTPFaultInjection.Abort.error_type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=5001,
-  serialized_end=5168,
+  serialized_start=4923,
+  serialized_end=5090,
 )
 
 _HTTPFAULTINJECTION = _descriptor.Descriptor(
@@ -1540,8 +1539,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4630,
-  serialized_end=5168,
+  serialized_start=4552,
+  serialized_end=5090,
 )
 
 
@@ -1581,8 +1580,8 @@
       name='port', full_name='istio.networking.v1alpha3.PortSelector.port',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=5170,
-  serialized_end=5226,
+  serialized_start=5092,
+  serialized_end=5148,
 )
 
 
@@ -1612,14 +1611,13 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5228,
-  serialized_end=5252,
+  serialized_start=5150,
+  serialized_end=5174,
 )
 
 _VIRTUALSERVICE.fields_by_name['http'].message_type = _HTTPROUTE
 _VIRTUALSERVICE.fields_by_name['tls'].message_type = _TLSROUTE
 _VIRTUALSERVICE.fields_by_name['tcp'].message_type = _TCPROUTE
-_VIRTUALSERVICE.fields_by_name['config_scope'].enum_type = networking_dot_v1alpha3_dot_sidecar__pb2._CONFIGSCOPE
 _DESTINATION.fields_by_name['port'].message_type = _PORTSELECTOR
 _HTTPROUTE_APPENDHEADERSENTRY.containing_type = _HTTPROUTE
 _HTTPROUTE_APPENDRESPONSEHEADERSENTRY.containing_type = _HTTPROUTE

From 13692cc0b295c660befde619a850bae7d97eb8ce Mon Sep 17 00:00:00 2001
From: Louis Ryan <lryan@google.com>
Date: Mon, 28 Jan 2019 10:18:08 -0800
Subject: [PATCH 2/2] Hide from docs and other misc fixes

---
 mesh/v1alpha1/config.pb.go                    |  17 +-
 mesh/v1alpha1/config.proto                    |  17 +-
 mesh/v1alpha1/istio.mesh.v1alpha1.pb.html     |   4 +-
 networking/v1alpha3/destination_rule.pb.go    | 184 +++++++++---------
 networking/v1alpha3/destination_rule.proto    |   6 +-
 .../istio.networking.v1alpha3.pb.html         |  58 +-----
 networking/v1alpha3/service_entry.pb.go       |   9 +-
 networking/v1alpha3/service_entry.proto       |   9 +-
 networking/v1alpha3/virtual_service.pb.go     |   2 +-
 networking/v1alpha3/virtual_service.proto     |   2 +-
 proto.lock                                    |   2 +-
 .../v1alpha3/destination_rule_pb2.py          |  66 +++----
 12 files changed, 164 insertions(+), 212 deletions(-)

diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index 70705629ff..b5116ae9d1 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -263,7 +263,7 @@ type MeshConfig struct {
 	// Fallback to old identity format(without trust domain) if not set.
 	TrustDomain string `protobuf:"bytes,26,opt,name=trust_domain,json=trustDomain,proto3" json:"trust_domain,omitempty"`
 	// $hide_from_docs
-	// The default value for the ServiceEntry.exportTo field and services
+	// The default value for the ServiceEntry.export_to field and services
 	// imported through container registry integrations, e.g. this applies to
 	// Kubernetes Service resources. The value is a list of namespace names and
 	// reserved namespace aliases. The allowed namespace aliases are:
@@ -289,14 +289,14 @@ type MeshConfig struct {
 	// Sidecar, and Gateway.
 	DefaultServiceExportTo []string `protobuf:"bytes,31,rep,name=default_service_export_to,json=defaultServiceExportTo" json:"default_service_export_to,omitempty"`
 	// $hide_from_docs
-	// The default value for the VirtualService.exportTo field. Has the same
+	// The default value for the VirtualService.export_to field. Has the same
 	// syntax as 'default_service_export_to'.
 	//
 	// If not set the system will use "*" as the default value which implies that
 	// virtual services are exported to all namespaces
 	DefaultVirtualServiceExportTo []string `protobuf:"bytes,32,rep,name=default_virtual_service_export_to,json=defaultVirtualServiceExportTo" json:"default_virtual_service_export_to,omitempty"`
 	// $hide_from_docs
-	// The default value for the DestinationRule.exportTo field. Has the same
+	// The default value for the DestinationRule.export_to field. Has the same
 	// syntax as 'default_service_export_to'.
 	//
 	// If not set the system will use "*" as the default value which implies that
@@ -304,9 +304,10 @@ type MeshConfig struct {
 	DefaultDestinationRuleExportTo []string `protobuf:"bytes,33,rep,name=default_destination_rule_export_to,json=defaultDestinationRuleExportTo" json:"default_destination_rule_export_to,omitempty"`
 	// $hide_from_docs
 	// The namespace to treat as the administrative root namespace for
-	// istio configuration. When processing a namespace Istio will treat
-	// declarations in the root namespace as if they belonged to each leaf
-	// namespace.
+	// istio configuration. When processing a leaf namespace Istio will search for
+	// declarations in that namespace first and if none are found it will
+	// search in the root namespace. Any matching declaration found in the root
+	// namespace is processed as if it were declared in the leaf namespace.
 	//
 	// The precise semantics of this processing are documented on each resource
 	// type.
@@ -621,8 +622,8 @@ func (m *ConfigSource) GetTlsSettings() *istio_networking_v1alpha31.TLSSettings
 // service originates from workloads in "us-west/zone1/*", 80% of the traffic
 // will be sent to endpoints in "us-west/zone1/*", i.e the same zone, and the
 // remaining 20% will go to endpoints in "us-west/zone2/*". This setup is
-// intended to favor routing traffic to endpoint in the same locality. A similar
-// setting is specified for traffic originating in "us-west/zone2/*".
+// intended to favor routing traffic to endpoints in the same locality.
+// A similar setting is specified for traffic originating in "us-west/zone2/*".
 //
 // ```yaml
 //   distribute:
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index 5e12c544e6..d3154a03bd 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -218,7 +218,7 @@ message MeshConfig {
   string trust_domain = 26;
 
   // $hide_from_docs
-  // The default value for the ServiceEntry.exportTo field and services
+  // The default value for the ServiceEntry.export_to field and services
   // imported through container registry integrations, e.g. this applies to
   // Kubernetes Service resources. The value is a list of namespace names and
   // reserved namespace aliases. The allowed namespace aliases are:
@@ -245,7 +245,7 @@ message MeshConfig {
   repeated string default_service_export_to = 31;
 
   // $hide_from_docs
-  // The default value for the VirtualService.exportTo field. Has the same
+  // The default value for the VirtualService.export_to field. Has the same
   // syntax as 'default_service_export_to'.
   //
   // If not set the system will use "*" as the default value which implies that
@@ -253,7 +253,7 @@ message MeshConfig {
   repeated string default_virtual_service_export_to = 32;
 
   // $hide_from_docs
-  // The default value for the DestinationRule.exportTo field. Has the same
+  // The default value for the DestinationRule.export_to field. Has the same
   // syntax as 'default_service_export_to'.
   //
   // If not set the system will use "*" as the default value which implies that
@@ -262,9 +262,10 @@ message MeshConfig {
 
   // $hide_from_docs
   // The namespace to treat as the administrative root namespace for
-  // istio configuration. When processing a namespace Istio will treat
-  // declarations in the root namespace as if they belonged to each leaf
-  // namespace.
+  // istio configuration. When processing a leaf namespace Istio will search for
+  // declarations in that namespace first and if none are found it will
+  // search in the root namespace. Any matching declaration found in the root
+  // namespace is processed as if it were declared in the leaf namespace.
   //
   // The precise semantics of this processing are documented on each resource
   // type.
@@ -313,8 +314,8 @@ message ConfigSource {
 // service originates from workloads in "us-west/zone1/*", 80% of the traffic
 // will be sent to endpoints in "us-west/zone1/*", i.e the same zone, and the
 // remaining 20% will go to endpoints in "us-west/zone2/*". This setup is
-// intended to favor routing traffic to endpoint in the same locality. A similar
-// setting is specified for traffic originating in "us-west/zone2/*".
+// intended to favor routing traffic to endpoints in the same locality.
+// A similar setting is specified for traffic originating in "us-west/zone2/*".
 //
 // ```yaml
 //   distribute:
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index beeb855225..5b63b96c6e 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -99,8 +99,8 @@ <h2 id="LocalityLoadBalancerSetting">LocalityLoadBalancerSetting</h2>
 service originates from workloads in &ldquo;us-west/zone1/<em>&rdquo;, 80% of the traffic
 will be sent to endpoints in &ldquo;us-west/zone1/</em>&rdquo;, i.e the same zone, and the
 remaining 20% will go to endpoints in &ldquo;us-west/zone2/<em>&rdquo;. This setup is
-intended to favor routing traffic to endpoint in the same locality. A similar
-setting is specified for traffic originating in &ldquo;us-west/zone2/</em>&rdquo;.</p>
+intended to favor routing traffic to endpoints in the same locality.
+A similar setting is specified for traffic originating in &ldquo;us-west/zone2/</em>&rdquo;.</p>
 
 <pre><code class="language-yaml">  distribute:
     - from: us-west/zone1/*
diff --git a/networking/v1alpha3/destination_rule.pb.go b/networking/v1alpha3/destination_rule.pb.go
index e6ec78ed48..1dd22cc9fc 100644
--- a/networking/v1alpha3/destination_rule.pb.go
+++ b/networking/v1alpha3/destination_rule.pb.go
@@ -250,11 +250,11 @@ type DestinationRule struct {
 	// One or more named sets that represent individual versions of a
 	// service. Traffic policies can be overridden at subset level.
 	Subsets []*Subset `protobuf:"bytes,3,rep,name=subsets" json:"subsets,omitempty"`
+	// $hide_from_docs
 	// The resolution of a DestinationRule to apply to a service occurs in the
-	// context of a hierarchy of namespaces. This rule control whether those
+	// context of a hierarchy of namespaces. This rule controls whether those
 	// namespaces are allowed to select this rule.
-	//
-	ExportTo []string `protobuf:"bytes,4,rep,name=exportTo" json:"exportTo,omitempty"`
+	ExportTo []string `protobuf:"bytes,4,rep,name=export_to,json=exportTo" json:"export_to,omitempty"`
 }
 
 func (m *DestinationRule) Reset()                    { *m = DestinationRule{} }
@@ -4527,93 +4527,93 @@ func init() {
 }
 
 var fileDescriptorDestinationRule = []byte{
-	// 1393 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x57, 0x4f, 0x6f, 0x1b, 0x45,
-	0x14, 0x8f, 0xff, 0x36, 0x7e, 0x4e, 0x1c, 0x67, 0x88, 0x8a, 0x6b, 0xa4, 0x34, 0x58, 0x88, 0x86,
-	0x42, 0xd7, 0x24, 0x15, 0x52, 0x69, 0x55, 0xd4, 0x38, 0xb1, 0xea, 0x50, 0x27, 0xb6, 0xc6, 0x8e,
-	0x84, 0x7a, 0x59, 0x8d, 0xd7, 0x13, 0x7b, 0x9a, 0xf5, 0xce, 0xb2, 0x33, 0x6b, 0x92, 0x7e, 0x06,
-	0xce, 0x15, 0x57, 0x2e, 0x7c, 0x16, 0xc4, 0x05, 0xae, 0x70, 0x01, 0xf5, 0x0b, 0x70, 0xe2, 0xc2,
-	0x09, 0xcd, 0xec, 0xac, 0xed, 0xb4, 0x69, 0xd2, 0x28, 0xf4, 0x36, 0x3b, 0xef, 0xfd, 0x7e, 0x33,
-	0xf3, 0x7e, 0x6f, 0xde, 0x9b, 0x85, 0xdb, 0x1e, 0x95, 0xdf, 0xf1, 0xe0, 0x88, 0x79, 0x83, 0xea,
-	0x78, 0x83, 0xb8, 0xfe, 0x90, 0xdc, 0xad, 0xf6, 0xa9, 0x90, 0xcc, 0x23, 0x92, 0x71, 0xcf, 0x0e,
-	0x42, 0x97, 0x5a, 0x7e, 0xc0, 0x25, 0x47, 0x37, 0x98, 0x90, 0x8c, 0x5b, 0x53, 0x84, 0x15, 0x23,
-	0xca, 0xab, 0x03, 0xce, 0x07, 0x2e, 0xad, 0x6a, 0xc7, 0x5e, 0x78, 0x58, 0xed, 0x87, 0x81, 0xc6,
-	0x47, 0xd0, 0xf2, 0x27, 0x67, 0x2d, 0x33, 0x66, 0x81, 0x0c, 0x89, 0x6b, 0x0b, 0x1a, 0x8c, 0x99,
-	0x63, 0x56, 0x29, 0xaf, 0x0c, 0xf8, 0x80, 0xeb, 0x61, 0x55, 0x8d, 0xa2, 0xd9, 0xca, 0xaf, 0x09,
-	0x58, 0xda, 0x99, 0x6e, 0x0b, 0x87, 0x2e, 0x45, 0x08, 0xd2, 0x43, 0x2e, 0x64, 0x29, 0xb1, 0x96,
-	0x58, 0xcf, 0x61, 0x3d, 0x46, 0x2d, 0x28, 0xc8, 0x80, 0x1c, 0x1e, 0x32, 0xc7, 0xf6, 0xb9, 0xcb,
-	0x9c, 0x93, 0x52, 0x72, 0x2d, 0xb1, 0x9e, 0xdf, 0x5c, 0xb7, 0xde, 0xb8, 0x79, 0xab, 0x1b, 0x01,
-	0xda, 0xda, 0x1f, 0x2f, 0xca, 0xd9, 0x4f, 0xf4, 0x00, 0xae, 0x89, 0xb0, 0x27, 0xa8, 0x14, 0xa5,
-	0xd4, 0x5a, 0x6a, 0x3d, 0xbf, 0xf9, 0xe1, 0x39, 0x4c, 0x1d, 0xed, 0x89, 0x63, 0x04, 0x2a, 0xc3,
-	0x3c, 0x3d, 0xf6, 0x79, 0x20, 0xbb, 0xbc, 0x94, 0x5e, 0x4b, 0xad, 0xe7, 0xf0, 0xe4, 0xbb, 0xf2,
-	0x47, 0x16, 0x16, 0x4f, 0xad, 0x8c, 0xba, 0xb0, 0xe8, 0x72, 0xd2, 0xb7, 0x7b, 0xc4, 0x25, 0x9e,
-	0x43, 0x03, 0x7d, 0xb0, 0xfc, 0x66, 0xf5, 0x9c, 0x05, 0x9b, 0x9c, 0xf4, 0x6b, 0xc6, 0xbd, 0x43,
-	0xa5, 0x64, 0xde, 0x40, 0xe0, 0x05, 0x77, 0x66, 0x16, 0x3d, 0x85, 0x25, 0x87, 0x7b, 0x1e, 0x75,
-	0xb4, 0x9c, 0x3e, 0xe7, 0xae, 0x09, 0xc9, 0xc6, 0x39, 0xbc, 0xdb, 0x13, 0x44, 0x9b, 0x73, 0x77,
-	0xc2, 0x5c, 0x70, 0x4e, 0xcd, 0xa3, 0x6f, 0x60, 0x99, 0x87, 0xd2, 0x65, 0x34, 0xb0, 0xfb, 0x54,
-	0x46, 0x86, 0x52, 0x4a, 0xb3, 0x7f, 0x7a, 0x0e, 0x7b, 0x2b, 0xc2, 0xec, 0xc4, 0x10, 0x5c, 0xe4,
-	0xaf, 0xcc, 0xa0, 0x7b, 0x90, 0x92, 0xae, 0x28, 0xa5, 0x35, 0xd7, 0xc7, 0xe7, 0x89, 0xd7, 0xec,
-	0x4c, 0xb6, 0xa7, 0x20, 0xe8, 0x19, 0xbc, 0xa7, 0x22, 0x6c, 0xbb, 0x74, 0x4c, 0x55, 0x6e, 0x45,
-	0xb6, 0x52, 0x46, 0x8b, 0x77, 0xff, 0x6d, 0xd3, 0xc0, 0x6a, 0x2b, 0x95, 0x4e, 0x25, 0xc6, 0xb2,
-	0xa2, 0x6d, 0x2a, 0xd6, 0x78, 0xc1, 0xf2, 0x8b, 0x14, 0x2c, 0xbf, 0xe6, 0x88, 0x1e, 0x40, 0x5a,
-	0xb9, 0x1a, 0xf9, 0x6e, 0x9d, 0xb3, 0xa4, 0xc2, 0x76, 0xa8, 0x4b, 0x1d, 0xc9, 0x03, 0xac, 0x41,
-	0xaf, 0x27, 0x41, 0xf2, 0x1d, 0x25, 0x41, 0xea, 0x9d, 0x26, 0x41, 0xfa, 0x7f, 0x4c, 0x82, 0xcc,
-	0xa5, 0x93, 0xa0, 0xf2, 0x77, 0x02, 0xb2, 0xd1, 0x65, 0x54, 0x55, 0xc2, 0x23, 0x23, 0x1a, 0x57,
-	0x09, 0x35, 0x46, 0x75, 0xc8, 0xba, 0xa4, 0x47, 0x5d, 0x51, 0x4a, 0xea, 0xb4, 0xb8, 0x73, 0xe1,
-	0x9d, 0xb6, 0x9a, 0xda, 0xbf, 0xee, 0xc9, 0xe0, 0x04, 0x1b, 0xf0, 0x19, 0xc5, 0x26, 0x75, 0xa5,
-	0x62, 0x53, 0xfe, 0x12, 0xf2, 0x33, 0xeb, 0xa0, 0x22, 0xa4, 0x8e, 0xe8, 0x89, 0xd9, 0xb9, 0x1a,
-	0xa2, 0x15, 0xc8, 0x8c, 0x89, 0x1b, 0x52, 0x9d, 0x15, 0x39, 0x1c, 0x7d, 0xdc, 0x4f, 0xde, 0x4b,
-	0x54, 0x7e, 0xca, 0xc0, 0xca, 0x59, 0x89, 0x80, 0x30, 0x64, 0x05, 0x1b, 0xf9, 0x6e, 0x14, 0x81,
-	0xc2, 0xe6, 0xbd, 0x4b, 0x66, 0x92, 0xd5, 0xd1, 0xe8, 0x66, 0xad, 0x31, 0x87, 0x0d, 0x13, 0x3a,
-	0xd2, 0xe9, 0x24, 0x98, 0x90, 0xd4, 0x93, 0xf6, 0x90, 0x88, 0xa1, 0x49, 0xd3, 0x47, 0x97, 0x25,
-	0xdf, 0x9e, 0xd0, 0x34, 0x88, 0x18, 0xea, 0x45, 0x0a, 0xce, 0xa9, 0xb9, 0xf2, 0x3f, 0x49, 0x28,
-	0xbe, 0xea, 0x86, 0x6e, 0x43, 0x71, 0x28, 0xa5, 0x6f, 0x0f, 0x29, 0xe9, 0xd3, 0xc0, 0x9e, 0x2a,
-	0xac, 0x08, 0x94, 0xa5, 0xa1, 0x0d, 0xfb, 0x4a, 0x6d, 0x0f, 0xf2, 0xda, 0xd7, 0xe1, 0xfc, 0x88,
-	0x51, 0xb3, 0xd3, 0x27, 0x57, 0xdd, 0xa9, 0xd5, 0xe8, 0x76, 0xdb, 0xdb, 0x9a, 0xb2, 0x31, 0x87,
-	0x41, 0xad, 0x10, 0x7d, 0xa1, 0x8f, 0x60, 0x31, 0x14, 0xd4, 0x16, 0x3c, 0x0c, 0x1c, 0x6a, 0x33,
-	0x5f, 0x67, 0xc5, 0x7c, 0x63, 0x0e, 0xe7, 0x43, 0x41, 0x3b, 0x7a, 0x76, 0xd7, 0x47, 0xb7, 0x61,
-	0x79, 0xc4, 0x3c, 0x36, 0x0a, 0x47, 0x76, 0xc0, 0xbc, 0x81, 0x2d, 0xd8, 0x73, 0xaa, 0xaf, 0x4d,
-	0x1a, 0x2f, 0x19, 0x03, 0x66, 0xde, 0xa0, 0xc3, 0x9e, 0xd3, 0xf2, 0x00, 0x60, 0xba, 0xda, 0x99,
-	0x19, 0x8d, 0x20, 0xed, 0x13, 0x39, 0x34, 0x79, 0xa1, 0xc7, 0x68, 0x03, 0x52, 0x52, 0xc6, 0x17,
-	0xfd, 0x86, 0x15, 0xb5, 0x68, 0x2b, 0x6e, 0xd1, 0xd6, 0x8e, 0x69, 0xd1, 0xb5, 0xf4, 0x0f, 0x7f,
-	0xde, 0x4c, 0x60, 0xe5, 0x5b, 0x03, 0x98, 0x57, 0x6a, 0xda, 0x47, 0xf4, 0xa4, 0xd2, 0x80, 0xf9,
-	0x58, 0x7a, 0xb4, 0x04, 0x79, 0xdc, 0x3a, 0xd8, 0xdf, 0xb1, 0x71, 0xab, 0xb6, 0xbb, 0x5f, 0x9c,
-	0x43, 0x05, 0x80, 0x66, 0x7d, 0xab, 0xd3, 0xb5, 0xb7, 0x5b, 0xfb, 0xfb, 0xc5, 0x04, 0x02, 0xc8,
-	0xe2, 0xad, 0xfd, 0x9d, 0xd6, 0x5e, 0x31, 0xa9, 0x9c, 0xdb, 0x5b, 0x9d, 0x4e, 0xb7, 0x81, 0x5b,
-	0x07, 0x8f, 0x1b, 0xc5, 0x54, 0x2d, 0x0f, 0x39, 0xb7, 0x67, 0xae, 0x48, 0xe5, 0x45, 0x16, 0xae,
-	0x9f, 0x5d, 0x59, 0x50, 0x0b, 0x52, 0xd2, 0xf1, 0x4d, 0xdd, 0x7c, 0x78, 0xe9, 0xca, 0x64, 0x75,
-	0xb7, 0xdb, 0x33, 0x65, 0xc0, 0xf1, 0x11, 0x86, 0xb4, 0xd2, 0xc5, 0x48, 0xfe, 0xd5, 0xe5, 0x19,
-	0x55, 0xd4, 0x27, 0x94, 0x9a, 0xab, 0xfc, 0x6f, 0x12, 0xf2, 0x33, 0x0b, 0xa1, 0x5b, 0xb0, 0x34,
-	0x22, 0xc7, 0xf6, 0xb4, 0x28, 0x0a, 0x7d, 0x80, 0x0c, 0x2e, 0x8c, 0xc8, 0xf1, 0x94, 0x56, 0xa0,
-	0xda, 0xa4, 0x06, 0xdb, 0x92, 0x8d, 0x28, 0x0f, 0xa5, 0xd9, 0xd7, 0x9b, 0xa5, 0x99, 0xd4, 0xda,
-	0x6e, 0x04, 0x40, 0x1c, 0x16, 0xa5, 0xe3, 0xdb, 0x47, 0x94, 0xfa, 0xc4, 0x65, 0x63, 0x6a, 0xc4,
-	0xfd, 0xfa, 0x4a, 0xb1, 0xb2, 0xba, 0x8e, 0xff, 0x24, 0x66, 0xc4, 0x0b, 0x72, 0xe6, 0xab, 0xfc,
-	0x7d, 0x02, 0x16, 0x66, 0xcd, 0xe8, 0x3a, 0x64, 0xfd, 0x80, 0xf7, 0x68, 0x74, 0xca, 0x45, 0x6c,
-	0xbe, 0xd0, 0x1d, 0x48, 0xab, 0x53, 0x5d, 0x7c, 0x24, 0xed, 0x86, 0xbe, 0x80, 0x79, 0xe6, 0x49,
-	0x1a, 0x8c, 0xc9, 0xc5, 0x09, 0x8a, 0x27, 0xae, 0xe5, 0xdf, 0x13, 0xb0, 0x30, 0xab, 0x09, 0x7a,
-	0x00, 0x65, 0xa5, 0xca, 0x86, 0xad, 0x34, 0xf0, 0xa9, 0xd7, 0x57, 0x57, 0x29, 0xa0, 0xdf, 0x86,
-	0x54, 0xc8, 0x58, 0x88, 0xf7, 0xb5, 0xc7, 0x1e, 0x39, 0x6e, 0x47, 0x76, 0x6c, 0xcc, 0xe8, 0x33,
-	0x40, 0xca, 0xb4, 0xa9, 0xc1, 0x13, 0x50, 0x52, 0x83, 0x74, 0x79, 0xd9, 0xdc, 0x23, 0xc7, 0x13,
-	0xef, 0x87, 0xf0, 0xc1, 0xac, 0x9f, 0xed, 0xd3, 0x60, 0x46, 0x75, 0x7d, 0x8a, 0x0c, 0x2e, 0x8d,
-	0xa6, 0x88, 0x36, 0x0d, 0xa6, 0xc1, 0x47, 0x37, 0x21, 0x1f, 0xc1, 0x65, 0xc0, 0x68, 0xf4, 0xb2,
-	0xc9, 0x60, 0xd0, 0xee, 0x7a, 0xa6, 0xf2, 0x63, 0x12, 0x8a, 0xaf, 0x36, 0x45, 0x74, 0x07, 0x90,
-	0x2a, 0x87, 0xd4, 0x09, 0x25, 0x1b, 0x53, 0x9b, 0x06, 0x01, 0x0f, 0xe2, 0x73, 0x2d, 0xcf, 0x58,
-	0xea, 0xda, 0x70, 0x2a, 0xac, 0xc9, 0xb7, 0x0e, 0x2b, 0x7a, 0x0c, 0xa8, 0x47, 0x04, 0xb5, 0xe9,
-	0x33, 0xf3, 0x42, 0xd0, 0x52, 0x5e, 0xa8, 0x4b, 0x51, 0x81, 0xea, 0x06, 0xa3, 0x52, 0x14, 0x7d,
-	0x0e, 0x2b, 0xea, 0x90, 0x13, 0x1e, 0x9f, 0x06, 0x0e, 0xf5, 0xa4, 0x39, 0x2d, 0x1a, 0x91, 0xe3,
-	0xd8, 0xbd, 0x1d, 0x59, 0x94, 0x06, 0x23, 0xe6, 0xa9, 0x3a, 0xee, 0xca, 0xe1, 0xc4, 0x3f, 0x13,
-	0x69, 0x30, 0x62, 0x5e, 0x43, 0x1b, 0x8c, 0x77, 0xe5, 0x17, 0x75, 0xf9, 0xa6, 0xcd, 0x1e, 0xd5,
-	0x20, 0x3d, 0xe2, 0xfd, 0xb8, 0xb5, 0x59, 0x6f, 0xf7, 0x44, 0x50, 0x63, 0x85, 0xc2, 0x1a, 0xab,
-	0x43, 0xec, 0x32, 0xd5, 0xc8, 0x1c, 0x1a, 0x48, 0x76, 0xc8, 0x1c, 0x22, 0xe3, 0x06, 0xbb, 0x1c,
-	0x59, 0xb6, 0xa7, 0x06, 0xa5, 0xa3, 0x1f, 0xb0, 0x31, 0x91, 0x54, 0x55, 0x49, 0x1d, 0xa4, 0x1c,
-	0x06, 0x33, 0xf5, 0x84, 0x9e, 0xa8, 0x82, 0xe0, 0x90, 0x59, 0xae, 0x48, 0xec, 0x1c, 0x2e, 0x38,
-	0x64, 0x86, 0x48, 0xa8, 0x0e, 0x20, 0xc2, 0x9e, 0x8a, 0x87, 0x4d, 0x5c, 0xa9, 0x7b, 0x58, 0xf4,
-	0x4e, 0xcd, 0xe1, 0x25, 0x63, 0xd8, 0x72, 0xa5, 0x6a, 0x61, 0x42, 0x3d, 0x05, 0x84, 0xc7, 0x4a,
-	0xd9, 0xe8, 0x29, 0x20, 0x3c, 0x56, 0x79, 0x04, 0xd7, 0xcc, 0x39, 0x50, 0x1e, 0xae, 0xed, 0xec,
-	0x76, 0xb6, 0x6a, 0xcd, 0x7a, 0x71, 0x4e, 0x55, 0xe2, 0xce, 0xee, 0x5e, 0xbb, 0x59, 0x8f, 0xaa,
-	0xf2, 0xde, 0x41, 0xf7, 0x60, 0xab, 0x59, 0x4c, 0xa2, 0x22, 0x2c, 0xec, 0x76, 0xba, 0xbb, 0x2d,
-	0xdb, 0xcc, 0xa4, 0x6a, 0xd6, 0xcf, 0x2f, 0x57, 0x13, 0xbf, 0xbd, 0x5c, 0x4d, 0xfc, 0xf5, 0x72,
-	0x35, 0xf1, 0x74, 0x2d, 0x8a, 0x1d, 0xe3, 0x55, 0xe2, 0xb3, 0xea, 0x19, 0xff, 0x6b, 0xbd, 0xac,
-	0xce, 0x80, 0xbb, 0xff, 0x05, 0x00, 0x00, 0xff, 0xff, 0xb6, 0x78, 0x29, 0xe1, 0x34, 0x0e, 0x00,
-	0x00,
+	// 1396 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x57, 0xcf, 0x6e, 0x1b, 0xb7,
+	0x13, 0xb6, 0xfe, 0xc6, 0x1a, 0xd9, 0xb2, 0xcc, 0x9f, 0x91, 0x9f, 0xa2, 0x00, 0x8e, 0x2b, 0x14,
+	0x8d, 0x9b, 0x36, 0xab, 0xda, 0x41, 0x81, 0x34, 0x41, 0x8a, 0x58, 0xb6, 0x10, 0xb9, 0x91, 0x2d,
+	0x81, 0x92, 0x81, 0x22, 0x97, 0x05, 0xb5, 0xa2, 0x25, 0xc6, 0xab, 0xe5, 0x76, 0xc9, 0x55, 0xed,
+	0x3c, 0x43, 0xcf, 0x41, 0xaf, 0xbd, 0xf4, 0x59, 0x8a, 0x9e, 0x72, 0x6d, 0x2f, 0x2d, 0xf2, 0x02,
+	0x3d, 0xf5, 0xd2, 0x53, 0x41, 0x2e, 0x57, 0x92, 0x13, 0xc7, 0x8e, 0xe1, 0xe6, 0xc6, 0xe5, 0xcc,
+	0xf7, 0x91, 0x9c, 0x6f, 0x38, 0xc3, 0x85, 0x3b, 0x1e, 0x95, 0xdf, 0xf3, 0xe0, 0x88, 0x79, 0x83,
+	0xea, 0x78, 0x83, 0xb8, 0xfe, 0x90, 0xdc, 0xab, 0xf6, 0xa9, 0x90, 0xcc, 0x23, 0x92, 0x71, 0xcf,
+	0x0e, 0x42, 0x97, 0x5a, 0x7e, 0xc0, 0x25, 0x47, 0x37, 0x98, 0x90, 0x8c, 0x5b, 0x53, 0x84, 0x15,
+	0x23, 0xca, 0xab, 0x03, 0xce, 0x07, 0x2e, 0xad, 0x6a, 0xc7, 0x5e, 0x78, 0x58, 0xed, 0x87, 0x81,
+	0xc6, 0x47, 0xd0, 0xf2, 0xa7, 0x67, 0x2d, 0x33, 0x66, 0x81, 0x0c, 0x89, 0x6b, 0x0b, 0x1a, 0x8c,
+	0x99, 0x63, 0x56, 0x29, 0xaf, 0x0c, 0xf8, 0x80, 0xeb, 0x61, 0x55, 0x8d, 0xa2, 0xd9, 0xca, 0xab,
+	0x04, 0x2c, 0xed, 0x4c, 0xb7, 0x85, 0x43, 0x97, 0x22, 0x04, 0xe9, 0x21, 0x17, 0xb2, 0x94, 0x58,
+	0x4b, 0xac, 0xe7, 0xb0, 0x1e, 0xa3, 0x16, 0x14, 0x64, 0x40, 0x0e, 0x0f, 0x99, 0x63, 0xfb, 0xdc,
+	0x65, 0xce, 0x49, 0x29, 0xb9, 0x96, 0x58, 0xcf, 0x6f, 0xae, 0x5b, 0xef, 0xdc, 0xbc, 0xd5, 0x8d,
+	0x00, 0x6d, 0xed, 0x8f, 0x17, 0xe5, 0xec, 0x27, 0x7a, 0x08, 0xd7, 0x44, 0xd8, 0x13, 0x54, 0x8a,
+	0x52, 0x6a, 0x2d, 0xb5, 0x9e, 0xdf, 0xfc, 0xe8, 0x1c, 0xa6, 0x8e, 0xf6, 0xc4, 0x31, 0x02, 0xdd,
+	0x84, 0x1c, 0x3d, 0xf6, 0x79, 0x20, 0x6d, 0xc9, 0x4b, 0xe9, 0xb5, 0xd4, 0x7a, 0x0e, 0xcf, 0x47,
+	0x13, 0x5d, 0x5e, 0xf9, 0x3d, 0x0b, 0x8b, 0xa7, 0x96, 0x46, 0x5d, 0x58, 0x74, 0x39, 0xe9, 0xdb,
+	0x3d, 0xe2, 0x12, 0xcf, 0xa1, 0x81, 0x3e, 0x59, 0x7e, 0xb3, 0x7a, 0xce, 0x8a, 0x4d, 0x4e, 0xfa,
+	0x35, 0xe3, 0xde, 0xa1, 0x52, 0x32, 0x6f, 0x20, 0xf0, 0x82, 0x3b, 0x33, 0x8b, 0x9e, 0xc1, 0x92,
+	0xc3, 0x3d, 0x8f, 0x3a, 0x5a, 0x4f, 0x9f, 0x73, 0xd7, 0xc4, 0x64, 0xe3, 0x1c, 0xde, 0xed, 0x09,
+	0xa2, 0xcd, 0xb9, 0x3b, 0x61, 0x2e, 0x38, 0xa7, 0xe6, 0xd1, 0xb7, 0xb0, 0xcc, 0x43, 0xe9, 0x32,
+	0x1a, 0xd8, 0x7d, 0x2a, 0x23, 0x43, 0x29, 0xa5, 0xd9, 0x3f, 0x3b, 0x87, 0xbd, 0x15, 0x61, 0x76,
+	0x62, 0x08, 0x2e, 0xf2, 0x37, 0x66, 0xd0, 0x7d, 0x48, 0x49, 0x57, 0x94, 0xd2, 0x9a, 0xeb, 0x93,
+	0xf3, 0xd4, 0x6b, 0x76, 0x26, 0xdb, 0x53, 0x10, 0xf4, 0x1c, 0xfe, 0xa7, 0x43, 0xee, 0xd2, 0x31,
+	0x55, 0xc9, 0x15, 0xd9, 0x4a, 0x19, 0xad, 0xde, 0x83, 0xf7, 0xcd, 0x03, 0xab, 0xad, 0x54, 0x3a,
+	0x95, 0x19, 0xcb, 0x8a, 0xb6, 0xa9, 0x58, 0xe3, 0x05, 0xcb, 0x2f, 0x53, 0xb0, 0xfc, 0x96, 0x23,
+	0x7a, 0x08, 0x69, 0xe5, 0x6a, 0xe4, 0xbb, 0x7d, 0xce, 0x92, 0x0a, 0xdb, 0xa1, 0x2e, 0x75, 0x24,
+	0x0f, 0xb0, 0x06, 0xbd, 0x9d, 0x04, 0xc9, 0x0f, 0x94, 0x04, 0xa9, 0x0f, 0x9a, 0x04, 0xe9, 0xff,
+	0x30, 0x09, 0x32, 0x97, 0x4e, 0x82, 0xca, 0x5f, 0x09, 0xc8, 0x46, 0xb7, 0x51, 0x95, 0x09, 0x8f,
+	0x8c, 0x68, 0x5c, 0x26, 0xd4, 0x18, 0xd5, 0x21, 0xeb, 0x92, 0x1e, 0x75, 0x45, 0x29, 0xa9, 0xd3,
+	0xe2, 0xee, 0x85, 0x97, 0xda, 0x6a, 0x6a, 0xff, 0xba, 0x27, 0x83, 0x13, 0x6c, 0xc0, 0x67, 0x54,
+	0x9b, 0xd4, 0x95, 0xaa, 0x4d, 0xf9, 0x2b, 0xc8, 0xcf, 0xac, 0x83, 0x8a, 0x90, 0x3a, 0xa2, 0x27,
+	0x66, 0xe7, 0x6a, 0x88, 0x56, 0x20, 0x33, 0x26, 0x6e, 0x48, 0x75, 0x56, 0xe4, 0x70, 0xf4, 0xf1,
+	0x20, 0x79, 0x3f, 0x51, 0xf9, 0x39, 0x03, 0x2b, 0x67, 0x25, 0x02, 0xc2, 0x90, 0x15, 0x6c, 0xe4,
+	0xbb, 0x51, 0x04, 0x0a, 0x9b, 0xf7, 0x2f, 0x99, 0x49, 0x56, 0x47, 0xa3, 0x9b, 0xb5, 0xc6, 0x1c,
+	0x36, 0x4c, 0xe8, 0x48, 0xa7, 0x93, 0x60, 0x42, 0x52, 0x4f, 0xda, 0x43, 0x22, 0x86, 0x26, 0x4d,
+	0x1f, 0x5f, 0x96, 0x7c, 0x7b, 0x42, 0xd3, 0x20, 0x62, 0xa8, 0x17, 0x29, 0x38, 0xa7, 0xe6, 0xca,
+	0x7f, 0x27, 0xa1, 0xf8, 0xa6, 0x1b, 0xba, 0x03, 0xc5, 0xa1, 0x94, 0xbe, 0x3d, 0xa4, 0xa4, 0x4f,
+	0x03, 0x7b, 0xaa, 0xb0, 0x22, 0x50, 0x96, 0x86, 0x36, 0xec, 0x2b, 0xb5, 0x3d, 0xc8, 0x6b, 0x5f,
+	0x87, 0xf3, 0x23, 0x46, 0xcd, 0x4e, 0x9f, 0x5e, 0x75, 0xa7, 0x56, 0xa3, 0xdb, 0x6d, 0x6f, 0x6b,
+	0xca, 0xc6, 0x1c, 0x06, 0xb5, 0x42, 0xf4, 0x85, 0x3e, 0x86, 0xc5, 0x50, 0x50, 0x5b, 0xf0, 0x30,
+	0x70, 0xa8, 0xcd, 0x7c, 0x9d, 0x15, 0xf3, 0x8d, 0x39, 0x9c, 0x0f, 0x05, 0xed, 0xe8, 0xd9, 0x5d,
+	0x1f, 0xdd, 0x81, 0xe5, 0x11, 0xf3, 0xd8, 0x28, 0x1c, 0xd9, 0x01, 0xf3, 0x06, 0xb6, 0x60, 0x2f,
+	0xa8, 0xbe, 0x36, 0x69, 0xbc, 0x64, 0x0c, 0x98, 0x79, 0x83, 0x0e, 0x7b, 0x41, 0xcb, 0x03, 0x80,
+	0xe9, 0x6a, 0x67, 0x66, 0x34, 0x82, 0xb4, 0x4f, 0xe4, 0xd0, 0xe4, 0x85, 0x1e, 0xa3, 0x0d, 0x48,
+	0x49, 0x19, 0x5f, 0xf4, 0x1b, 0x56, 0xd4, 0xa3, 0xad, 0xb8, 0x47, 0x5b, 0x3b, 0xa6, 0x47, 0xd7,
+	0xd2, 0x3f, 0xfe, 0x71, 0x2b, 0x81, 0x95, 0x6f, 0x0d, 0x60, 0x5e, 0xa9, 0x69, 0x1f, 0xd1, 0x93,
+	0x4a, 0x03, 0xe6, 0x63, 0xe9, 0xd1, 0x12, 0xe4, 0x71, 0xeb, 0x60, 0x7f, 0xc7, 0xc6, 0xad, 0xda,
+	0xee, 0x7e, 0x71, 0x0e, 0x15, 0x00, 0x9a, 0xf5, 0xad, 0x4e, 0xd7, 0xde, 0x6e, 0xed, 0xef, 0x17,
+	0x13, 0x08, 0x20, 0x8b, 0xb7, 0xf6, 0x77, 0x5a, 0x7b, 0xc5, 0xa4, 0x72, 0x6e, 0x6f, 0x75, 0x3a,
+	0xdd, 0x06, 0x6e, 0x1d, 0x3c, 0x69, 0x14, 0x53, 0xb5, 0x3c, 0xe4, 0xdc, 0x9e, 0xb9, 0x22, 0x95,
+	0x97, 0x59, 0xb8, 0x7e, 0x76, 0x65, 0x41, 0x2d, 0x48, 0x49, 0xc7, 0x37, 0x75, 0xf3, 0xd1, 0xa5,
+	0x2b, 0x93, 0xd5, 0xdd, 0x6e, 0xcf, 0x94, 0x01, 0xc7, 0x47, 0x18, 0xd2, 0x4a, 0x17, 0x23, 0xf9,
+	0xd7, 0x97, 0x67, 0x54, 0x51, 0x9f, 0x50, 0x6a, 0xae, 0xf2, 0x3f, 0x49, 0xc8, 0xcf, 0x2c, 0x84,
+	0x6e, 0xc3, 0xd2, 0x88, 0x1c, 0xdb, 0xd3, 0xa2, 0x28, 0xf4, 0x01, 0x32, 0xb8, 0x30, 0x22, 0xc7,
+	0x53, 0x5a, 0x81, 0x6a, 0x93, 0x1a, 0x6c, 0x4b, 0x36, 0xa2, 0x3c, 0x94, 0x66, 0x5f, 0xef, 0x96,
+	0x66, 0x52, 0x6b, 0xbb, 0x11, 0x00, 0x71, 0x58, 0x94, 0x8e, 0x6f, 0x1f, 0x51, 0xea, 0x13, 0x97,
+	0x8d, 0xa9, 0x11, 0xf7, 0x9b, 0x2b, 0xc5, 0xca, 0xea, 0x3a, 0xfe, 0xd3, 0x98, 0x11, 0x2f, 0xc8,
+	0x99, 0xaf, 0xf2, 0x0f, 0x09, 0x58, 0x98, 0x35, 0xa3, 0xeb, 0x90, 0xf5, 0x03, 0xde, 0xa3, 0xd1,
+	0x29, 0x17, 0xb1, 0xf9, 0x42, 0x77, 0x21, 0xad, 0x4e, 0x75, 0xf1, 0x91, 0xb4, 0x1b, 0xfa, 0x12,
+	0xe6, 0x99, 0x27, 0x69, 0x30, 0x26, 0x17, 0x27, 0x28, 0x9e, 0xb8, 0x96, 0x7f, 0x4b, 0xc0, 0xc2,
+	0xac, 0x26, 0xe8, 0x21, 0x94, 0x95, 0x2a, 0x1b, 0xb6, 0xd2, 0xc0, 0xa7, 0x5e, 0x5f, 0x5d, 0xa5,
+	0x80, 0x7e, 0x17, 0x52, 0x21, 0x63, 0x21, 0xfe, 0xaf, 0x3d, 0xf6, 0xc8, 0x71, 0x3b, 0xb2, 0x63,
+	0x63, 0x46, 0x9f, 0x03, 0x52, 0xa6, 0x4d, 0x0d, 0x9e, 0x80, 0x92, 0x1a, 0xa4, 0xcb, 0xcb, 0xe6,
+	0x1e, 0x39, 0x9e, 0x78, 0x3f, 0x82, 0x9b, 0xb3, 0x7e, 0xb6, 0x4f, 0x83, 0x19, 0xd5, 0xf5, 0x29,
+	0x32, 0xb8, 0x34, 0x9a, 0x22, 0xda, 0x34, 0x98, 0x06, 0x1f, 0xdd, 0x82, 0x7c, 0x04, 0x97, 0x01,
+	0xa3, 0xd1, 0xcb, 0x26, 0x83, 0x41, 0xbb, 0xeb, 0x99, 0xca, 0x4f, 0x49, 0x28, 0xbe, 0xd9, 0x14,
+	0xd1, 0x5d, 0x40, 0xaa, 0x1c, 0x52, 0x27, 0x94, 0x6c, 0x4c, 0x6d, 0x1a, 0x04, 0x3c, 0x88, 0xcf,
+	0xb5, 0x3c, 0x63, 0xa9, 0x6b, 0xc3, 0xa9, 0xb0, 0x26, 0xdf, 0x3b, 0xac, 0xe8, 0x09, 0xa0, 0x1e,
+	0x11, 0xd4, 0xa6, 0xcf, 0xcd, 0x0b, 0x41, 0x4b, 0x79, 0xa1, 0x2e, 0x45, 0x05, 0xaa, 0x1b, 0x8c,
+	0x4a, 0x51, 0xf4, 0x05, 0xac, 0xa8, 0x43, 0x4e, 0x78, 0x7c, 0x1a, 0x38, 0xd4, 0x93, 0xe6, 0xb4,
+	0x68, 0x44, 0x8e, 0x63, 0xf7, 0x76, 0x64, 0x51, 0x1a, 0x8c, 0x98, 0xa7, 0xea, 0xb8, 0x2b, 0x87,
+	0x13, 0xff, 0x4c, 0xa4, 0xc1, 0x88, 0x79, 0x0d, 0x6d, 0x30, 0xde, 0x95, 0x5f, 0xd5, 0xe5, 0x9b,
+	0x36, 0x7b, 0x54, 0x83, 0xf4, 0x88, 0xf7, 0xe3, 0xd6, 0x66, 0xbd, 0xdf, 0x13, 0x41, 0x8d, 0x15,
+	0x0a, 0x6b, 0xac, 0x0e, 0xb1, 0xcb, 0x54, 0x23, 0x73, 0x68, 0x20, 0xd9, 0x21, 0x73, 0x88, 0x8c,
+	0x1b, 0xec, 0x72, 0x64, 0xd9, 0x9e, 0x1a, 0x94, 0x8e, 0x7e, 0xc0, 0xc6, 0x44, 0x52, 0x55, 0x25,
+	0x75, 0x90, 0x72, 0x18, 0xcc, 0xd4, 0x53, 0x7a, 0xa2, 0x0a, 0x82, 0x43, 0x66, 0xb9, 0x22, 0xb1,
+	0x73, 0xb8, 0xe0, 0x90, 0x19, 0x22, 0xa1, 0x3a, 0x80, 0x08, 0x7b, 0x2a, 0x1e, 0x36, 0x71, 0xa5,
+	0xee, 0x61, 0xd1, 0x3b, 0x35, 0x87, 0x97, 0x8c, 0x61, 0xcb, 0x95, 0xaa, 0x85, 0x09, 0xf5, 0x14,
+	0x10, 0x1e, 0x2b, 0x65, 0xa3, 0xa7, 0x80, 0xf0, 0x58, 0xe5, 0x31, 0x5c, 0x33, 0xe7, 0x40, 0x79,
+	0xb8, 0xb6, 0xb3, 0xdb, 0xd9, 0xaa, 0x35, 0xeb, 0xc5, 0x39, 0x55, 0x89, 0x3b, 0xbb, 0x7b, 0xed,
+	0x66, 0x3d, 0xaa, 0xca, 0x7b, 0x07, 0xdd, 0x83, 0xad, 0x66, 0x31, 0x89, 0x8a, 0xb0, 0xb0, 0xdb,
+	0xe9, 0xee, 0xb6, 0x6c, 0x33, 0x93, 0xaa, 0x59, 0xbf, 0xbc, 0x5e, 0x4d, 0xbc, 0x7a, 0xbd, 0x9a,
+	0xf8, 0xf3, 0xf5, 0x6a, 0xe2, 0xd9, 0x5a, 0x14, 0x3b, 0xc6, 0xab, 0xc4, 0x67, 0xd5, 0x33, 0x7e,
+	0xd8, 0x7a, 0x59, 0x9d, 0x01, 0xf7, 0xfe, 0x0d, 0x00, 0x00, 0xff, 0xff, 0xfd, 0x7d, 0x30, 0x94,
+	0x35, 0x0e, 0x00, 0x00,
 }
diff --git a/networking/v1alpha3/destination_rule.proto b/networking/v1alpha3/destination_rule.proto
index d8cea55827..f622a2670e 100644
--- a/networking/v1alpha3/destination_rule.proto
+++ b/networking/v1alpha3/destination_rule.proto
@@ -118,11 +118,11 @@ message DestinationRule {
   // service. Traffic policies can be overridden at subset level.
   repeated Subset subsets = 3;
 
+  // $hide_from_docs
   // The resolution of a DestinationRule to apply to a service occurs in the
-  // context of a hierarchy of namespaces. This rule control whether those
+  // context of a hierarchy of namespaces. This rule controls whether those
   // namespaces are allowed to select this rule.
-  //
-  repeated string exportTo = 4;
+  repeated string export_to = 4;
 }
 
 // Traffic policies to apply for a specific destination, across all
diff --git a/networking/v1alpha3/istio.networking.v1alpha3.pb.html b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
index 140dadbfef..d4b3616627 100644
--- a/networking/v1alpha3/istio.networking.v1alpha3.pb.html
+++ b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
@@ -669,16 +669,6 @@ <h2 id="DestinationRule">DestinationRule</h2>
 <p>One or more named sets that represent individual versions of a
 service. Traffic policies can be overridden at subset level.</p>
 
-</td>
-</tr>
-<tr id="DestinationRule-exportTo">
-<td><code>exportTo</code></td>
-<td><code>string[]</code></td>
-<td>
-<p>The resolution of a DestinationRule to apply to a service occurs in the
-context of a hierarchy of namespaces. This rule control whether those
-namespaces are allowed to select this rule.</p>
-
 </td>
 </tr>
 </tbody>
@@ -3232,7 +3222,7 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 
 <p>The following example demonstrates the use of a dedicated egress gateway
 through which all external service traffic is forwarded.
-The &lsquo;exportTo&rsquo; field allows for control over the visibility of a service
+The &lsquo;export_to&rsquo; field allows for control over the visibility of a service
 declaration to other namespaces in the mesh. By default a service is exported
 to all namespaces. The following example restricts the visibility to the
 current namespace, represented by &ldquo;.&rdquo;, so that it cannot be used by other
@@ -3246,7 +3236,7 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 spec:
   hosts:
   - httpbin.com
-  exportTo:
+  export_to:
   - .
   location: MESH_EXTERNAL
   ports:
@@ -3290,7 +3280,7 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 spec:
   hosts:
   - httpbin.com
-  exportTo:
+  export_to:
   - *
   gateways:
   - mesh
@@ -3470,29 +3460,6 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 <td>
 <p>One or more endpoints associated with the service.</p>
 
-</td>
-</tr>
-<tr id="ServiceEntry-export_to">
-<td><code>exportTo</code></td>
-<td><code>string[]</code></td>
-<td>
-<p>A list of namespaces to which this service is exported. Exporting a service
-allows it to used by sidecars, gateways and virtual services defined in
-other namespaces. This feature provides a mechanism for service owners
-and mesh administrators to control the visibility of services across
-namespace boundaries.</p>
-
-<p>If no namespaces are specified then the service is exported to all
-namespaces by default.</p>
-
-<p>The value &ldquo;.&rdquo; is reserved and defines an export to the same namespace that
-the service is declared in, similarly the value &ldquo;*&rdquo; is reserved and
-defines an export to all namespaces.</p>
-
-<p>For a Kubernetes Service the equivalent effect can be achieved by setting
-the annotation &ldquo;networking.istio.io/exportTo&rdquo; to a comma-separated list
-of namespace names.</p>
-
 </td>
 </tr>
 </tbody>
@@ -4558,25 +4525,6 @@ <h2 id="VirtualService">VirtualService</h2>
 be applied to any port that is not a HTTP or TLS port. The first rule
 matching an incoming request is used.</p>
 
-</td>
-</tr>
-<tr id="VirtualService-export_to">
-<td><code>exportTo</code></td>
-<td><code>string[]</code></td>
-<td>
-<p>A list of namespaces to which this virtual service is exported. Exporting a
-virtual service allows it to used by sidecars and gateways defined in
-other namespaces. This feature provides a mechanism for service owners
-and mesh administrators to control the visibility of virtual services
-across namespace boundaries.</p>
-
-<p>If no namespaces are specified then the virtual service is exported to all
-namespaces by default.</p>
-
-<p>The value &ldquo;.&rdquo; is reserved and defines an export to the same namespace that
-the virtual service is declared in, similarly the value &ldquo;*&rdquo; is reserved and
-defines an export to all namespaces.</p>
-
 </td>
 </tr>
 </tbody>
diff --git a/networking/v1alpha3/service_entry.pb.go b/networking/v1alpha3/service_entry.pb.go
index 810b9c58ac..b1125abe5f 100644
--- a/networking/v1alpha3/service_entry.pb.go
+++ b/networking/v1alpha3/service_entry.pb.go
@@ -213,7 +213,7 @@ func (ServiceEntry_Resolution) EnumDescriptor() ([]byte, []int) {
 //
 // The following example demonstrates the use of a dedicated egress gateway
 // through which all external service traffic is forwarded.
-// The 'exportTo' field allows for control over the visibility of a service
+// The 'export_to' field allows for control over the visibility of a service
 // declaration to other namespaces in the mesh. By default a service is exported
 // to all namespaces. The following example restricts the visibility to the
 // current namespace, represented by ".", so that it cannot be used by other
@@ -228,7 +228,7 @@ func (ServiceEntry_Resolution) EnumDescriptor() ([]byte, []int) {
 // spec:
 //   hosts:
 //   - httpbin.com
-//   exportTo:
+//   export_to:
 //   - .
 //   location: MESH_EXTERNAL
 //   ports:
@@ -274,7 +274,7 @@ func (ServiceEntry_Resolution) EnumDescriptor() ([]byte, []int) {
 // spec:
 //   hosts:
 //   - httpbin.com
-//   exportTo:
+//   export_to:
 //   - *
 //   gateways:
 //   - mesh
@@ -415,6 +415,7 @@ type ServiceEntry struct {
 	Resolution ServiceEntry_Resolution `protobuf:"varint,5,opt,name=resolution,proto3,enum=istio.networking.v1alpha3.ServiceEntry_Resolution" json:"resolution,omitempty"`
 	// One or more endpoints associated with the service.
 	Endpoints []*ServiceEntry_Endpoint `protobuf:"bytes,6,rep,name=endpoints" json:"endpoints,omitempty"`
+	// $hide_from_docs
 	// A list of namespaces to which this service is exported. Exporting a service
 	// allows it to used by sidecars, gateways and virtual services defined in
 	// other namespaces. This feature provides a mechanism for service owners
@@ -429,7 +430,7 @@ type ServiceEntry struct {
 	// defines an export to all namespaces.
 	//
 	// For a Kubernetes Service the equivalent effect can be achieved by setting
-	// the annotation "networking.istio.io/exportTo" to a comma-separated list
+	// the annotation "networking.istio.io/export_to" to a comma-separated list
 	// of namespace names.
 	ExportTo []string `protobuf:"bytes,7,rep,name=export_to,json=exportTo" json:"export_to,omitempty"`
 }
diff --git a/networking/v1alpha3/service_entry.proto b/networking/v1alpha3/service_entry.proto
index ccd7724c51..63b9cb52fd 100644
--- a/networking/v1alpha3/service_entry.proto
+++ b/networking/v1alpha3/service_entry.proto
@@ -134,7 +134,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 //
 // The following example demonstrates the use of a dedicated egress gateway
 // through which all external service traffic is forwarded.
-// The 'exportTo' field allows for control over the visibility of a service
+// The 'export_to' field allows for control over the visibility of a service
 // declaration to other namespaces in the mesh. By default a service is exported
 // to all namespaces. The following example restricts the visibility to the
 // current namespace, represented by ".", so that it cannot be used by other
@@ -149,7 +149,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // spec:
 //   hosts:
 //   - httpbin.com
-//   exportTo:
+//   export_to:
 //   - .
 //   location: MESH_EXTERNAL
 //   ports:
@@ -195,7 +195,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // spec:
 //   hosts:
 //   - httpbin.com
-//   exportTo:
+//   export_to:
 //   - *
 //   gateways:
 //   - mesh
@@ -443,6 +443,7 @@ message ServiceEntry {
   // One or more endpoints associated with the service.
   repeated Endpoint endpoints = 6;
 
+  // $hide_from_docs
   // A list of namespaces to which this service is exported. Exporting a service
   // allows it to used by sidecars, gateways and virtual services defined in
   // other namespaces. This feature provides a mechanism for service owners
@@ -457,7 +458,7 @@ message ServiceEntry {
   // defines an export to all namespaces.
   //
   // For a Kubernetes Service the equivalent effect can be achieved by setting
-  // the annotation "networking.istio.io/exportTo" to a comma-separated list
+  // the annotation "networking.istio.io/export_to" to a comma-separated list
   // of namespace names.
   repeated string export_to = 7;
 }
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index 2fe372d65c..46799d78cf 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -134,6 +134,7 @@ type VirtualService struct {
 	// be applied to any port that is not a HTTP or TLS port. The first rule
 	// matching an incoming request is used.
 	Tcp []*TCPRoute `protobuf:"bytes,4,rep,name=tcp" json:"tcp,omitempty"`
+	// $hide_from_docs
 	// A list of namespaces to which this virtual service is exported. Exporting a
 	// virtual service allows it to used by sidecars and gateways defined in
 	// other namespaces. This feature provides a mechanism for service owners
@@ -146,7 +147,6 @@ type VirtualService struct {
 	// The value "." is reserved and defines an export to the same namespace that
 	// the virtual service is declared in, similarly the value "*" is reserved and
 	// defines an export to all namespaces.
-	//
 	ExportTo []string `protobuf:"bytes,6,rep,name=export_to,json=exportTo" json:"export_to,omitempty"`
 }
 
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index c85a3222b3..925cd58bcd 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -176,6 +176,7 @@ message VirtualService {
   // matching an incoming request is used.
   repeated TCPRoute tcp = 4;
 
+  // $hide_from_docs
   // A list of namespaces to which this virtual service is exported. Exporting a
   // virtual service allows it to used by sidecars and gateways defined in
   // other namespaces. This feature provides a mechanism for service owners
@@ -188,7 +189,6 @@ message VirtualService {
   // The value "." is reserved and defines an export to the same namespace that
   // the virtual service is declared in, similarly the value "*" is reserved and
   // defines an export to all namespaces.
-  //
   repeated string export_to = 6;
 }
 
diff --git a/proto.lock b/proto.lock
index ca542d4f75..c0b4dd150f 100644
--- a/proto.lock
+++ b/proto.lock
@@ -2678,7 +2678,7 @@
               },
               {
                 "id": 4,
-                "name": "exportTo",
+                "name": "export_to",
                 "type": "string",
                 "is_repeated": true
               }
diff --git a/python/istio_api/networking/v1alpha3/destination_rule_pb2.py b/python/istio_api/networking/v1alpha3/destination_rule_pb2.py
index 1d08e8242d..0ce0d8c602 100644
--- a/python/istio_api/networking/v1alpha3/destination_rule_pb2.py
+++ b/python/istio_api/networking/v1alpha3/destination_rule_pb2.py
@@ -22,7 +22,7 @@
   name='networking/v1alpha3/destination_rule.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n*networking/v1alpha3/destination_rule.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a)networking/v1alpha3/virtual_service.proto\x1a\x14gogoproto/gogo.proto\"\xa7\x01\n\x0f\x44\x65stinationRule\x12\x0c\n\x04host\x18\x01 \x01(\t\x12@\n\x0etraffic_policy\x18\x02 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x12\x32\n\x07subsets\x18\x03 \x03(\x0b\x32!.istio.networking.v1alpha3.Subset\x12\x10\n\x08\x65xportTo\x18\x04 \x03(\t\"\xd7\x05\n\rTrafficPolicy\x12\x46\n\rload_balancer\x18\x01 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x02 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x03 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\x12W\n\x13port_level_settings\x18\x05 \x03(\x0b\x32:.istio.networking.v1alpha3.TrafficPolicy.PortTrafficPolicy\x1a\xdb\x02\n\x11PortTrafficPolicy\x12\x35\n\x04port\x18\x01 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\x12\x46\n\rload_balancer\x18\x02 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x03 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x04 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x05 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\"\xc6\x01\n\x06Subset\x12\x0c\n\x04name\x18\x01 \x01(\t\x12=\n\x06labels\x18\x02 \x03(\x0b\x32-.istio.networking.v1alpha3.Subset.LabelsEntry\x12@\n\x0etraffic_policy\x18\x03 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc3\x04\n\x14LoadBalancerSettings\x12J\n\x06simple\x18\x01 \x01(\x0e\x32\x38.istio.networking.v1alpha3.LoadBalancerSettings.SimpleLBH\x00\x12[\n\x0f\x63onsistent_hash\x18\x02 \x01(\x0b\x32@.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLBH\x00\x1a\xaa\x02\n\x10\x43onsistentHashLB\x12\x1a\n\x10http_header_name\x18\x01 \x01(\tH\x00\x12\x62\n\x0bhttp_cookie\x18\x02 \x01(\x0b\x32K.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLB.HTTPCookieH\x00\x12\x17\n\ruse_source_ip\x18\x03 \x01(\x08H\x00\x12\x19\n\x11minimum_ring_size\x18\x04 \x01(\x04\x1aV\n\nHTTPCookie\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04path\x18\x02 \x01(\t\x12,\n\x03ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x04\x98\xdf\x1f\x01\x42\n\n\x08hash_key\"H\n\x08SimpleLB\x12\x0f\n\x0bROUND_ROBIN\x10\x00\x12\x0e\n\nLEAST_CONN\x10\x01\x12\n\n\x06RANDOM\x10\x02\x12\x0f\n\x0bPASSTHROUGH\x10\x03\x42\x0b\n\tlb_policy\"\xf3\x04\n\x16\x43onnectionPoolSettings\x12J\n\x03tcp\x18\x01 \x01(\x0b\x32=.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings\x12L\n\x04http\x18\x02 \x01(\x0b\x32>.istio.networking.v1alpha3.ConnectionPoolSettings.HTTPSettings\x1a\xb3\x02\n\x0bTCPSettings\x12\x17\n\x0fmax_connections\x18\x01 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x03 \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x1at\n\x0cTcpKeepalive\x12\x0e\n\x06probes\x18\x01 \x01(\r\x12\'\n\x04time\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12+\n\x08interval\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x1a\x88\x01\n\x0cHTTPSettings\x12\"\n\x1ahttp1_max_pending_requests\x18\x01 \x01(\x05\x12\x1a\n\x12http2_max_requests\x18\x02 \x01(\x05\x12#\n\x1bmax_requests_per_connection\x18\x03 \x01(\x05\x12\x13\n\x0bmax_retries\x18\x04 \x01(\x05\"\xcc\x01\n\x10OutlierDetection\x12\x1a\n\x12\x63onsecutive_errors\x18\x01 \x01(\x05\x12+\n\x08interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x12\x62\x61se_ejection_time\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1c\n\x14max_ejection_percent\x18\x04 \x01(\x05\x12\x1a\n\x12min_health_percent\x18\x05 \x01(\x05\"\xff\x01\n\x0bTLSSettings\x12<\n\x04mode\x18\x01 \x01(\x0e\x32..istio.networking.v1alpha3.TLSSettings.TLSmode\x12\x1a\n\x12\x63lient_certificate\x18\x02 \x01(\t\x12\x13\n\x0bprivate_key\x18\x03 \x01(\t\x12\x17\n\x0f\x63\x61_certificates\x18\x04 \x01(\t\x12\x19\n\x11subject_alt_names\x18\x05 \x03(\t\x12\x0b\n\x03sni\x18\x06 \x01(\t\"@\n\x07TLSmode\x12\x0b\n\x07\x44ISABLE\x10\x00\x12\n\n\x06SIMPLE\x10\x01\x12\n\n\x06MUTUAL\x10\x02\x12\x10\n\x0cISTIO_MUTUAL\x10\x03\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n*networking/v1alpha3/destination_rule.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a)networking/v1alpha3/virtual_service.proto\x1a\x14gogoproto/gogo.proto\"\xa8\x01\n\x0f\x44\x65stinationRule\x12\x0c\n\x04host\x18\x01 \x01(\t\x12@\n\x0etraffic_policy\x18\x02 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x12\x32\n\x07subsets\x18\x03 \x03(\x0b\x32!.istio.networking.v1alpha3.Subset\x12\x11\n\texport_to\x18\x04 \x03(\t\"\xd7\x05\n\rTrafficPolicy\x12\x46\n\rload_balancer\x18\x01 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x02 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x03 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\x12W\n\x13port_level_settings\x18\x05 \x03(\x0b\x32:.istio.networking.v1alpha3.TrafficPolicy.PortTrafficPolicy\x1a\xdb\x02\n\x11PortTrafficPolicy\x12\x35\n\x04port\x18\x01 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\x12\x46\n\rload_balancer\x18\x02 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x03 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x04 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x05 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\"\xc6\x01\n\x06Subset\x12\x0c\n\x04name\x18\x01 \x01(\t\x12=\n\x06labels\x18\x02 \x03(\x0b\x32-.istio.networking.v1alpha3.Subset.LabelsEntry\x12@\n\x0etraffic_policy\x18\x03 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc3\x04\n\x14LoadBalancerSettings\x12J\n\x06simple\x18\x01 \x01(\x0e\x32\x38.istio.networking.v1alpha3.LoadBalancerSettings.SimpleLBH\x00\x12[\n\x0f\x63onsistent_hash\x18\x02 \x01(\x0b\x32@.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLBH\x00\x1a\xaa\x02\n\x10\x43onsistentHashLB\x12\x1a\n\x10http_header_name\x18\x01 \x01(\tH\x00\x12\x62\n\x0bhttp_cookie\x18\x02 \x01(\x0b\x32K.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLB.HTTPCookieH\x00\x12\x17\n\ruse_source_ip\x18\x03 \x01(\x08H\x00\x12\x19\n\x11minimum_ring_size\x18\x04 \x01(\x04\x1aV\n\nHTTPCookie\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04path\x18\x02 \x01(\t\x12,\n\x03ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x04\x98\xdf\x1f\x01\x42\n\n\x08hash_key\"H\n\x08SimpleLB\x12\x0f\n\x0bROUND_ROBIN\x10\x00\x12\x0e\n\nLEAST_CONN\x10\x01\x12\n\n\x06RANDOM\x10\x02\x12\x0f\n\x0bPASSTHROUGH\x10\x03\x42\x0b\n\tlb_policy\"\xf3\x04\n\x16\x43onnectionPoolSettings\x12J\n\x03tcp\x18\x01 \x01(\x0b\x32=.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings\x12L\n\x04http\x18\x02 \x01(\x0b\x32>.istio.networking.v1alpha3.ConnectionPoolSettings.HTTPSettings\x1a\xb3\x02\n\x0bTCPSettings\x12\x17\n\x0fmax_connections\x18\x01 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x03 \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x1at\n\x0cTcpKeepalive\x12\x0e\n\x06probes\x18\x01 \x01(\r\x12\'\n\x04time\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12+\n\x08interval\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x1a\x88\x01\n\x0cHTTPSettings\x12\"\n\x1ahttp1_max_pending_requests\x18\x01 \x01(\x05\x12\x1a\n\x12http2_max_requests\x18\x02 \x01(\x05\x12#\n\x1bmax_requests_per_connection\x18\x03 \x01(\x05\x12\x13\n\x0bmax_retries\x18\x04 \x01(\x05\"\xcc\x01\n\x10OutlierDetection\x12\x1a\n\x12\x63onsecutive_errors\x18\x01 \x01(\x05\x12+\n\x08interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x12\x62\x61se_ejection_time\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1c\n\x14max_ejection_percent\x18\x04 \x01(\x05\x12\x1a\n\x12min_health_percent\x18\x05 \x01(\x05\"\xff\x01\n\x0bTLSSettings\x12<\n\x04mode\x18\x01 \x01(\x0e\x32..istio.networking.v1alpha3.TLSSettings.TLSmode\x12\x1a\n\x12\x63lient_certificate\x18\x02 \x01(\t\x12\x13\n\x0bprivate_key\x18\x03 \x01(\t\x12\x17\n\x0f\x63\x61_certificates\x18\x04 \x01(\t\x12\x19\n\x11subject_alt_names\x18\x05 \x03(\t\x12\x0b\n\x03sni\x18\x06 \x01(\t\"@\n\x07TLSmode\x12\x0b\n\x07\x44ISABLE\x10\x00\x12\n\n\x06SIMPLE\x10\x01\x12\n\n\x06MUTUAL\x10\x02\x12\x10\n\x0cISTIO_MUTUAL\x10\x03\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_virtual__service__pb2.DESCRIPTOR,gogoproto_dot_gogo__pb2.DESCRIPTOR,])
 
@@ -53,8 +53,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1766,
-  serialized_end=1838,
+  serialized_start=1767,
+  serialized_end=1839,
 )
 _sym_db.RegisterEnumDescriptor(_LOADBALANCERSETTINGS_SIMPLELB)
 
@@ -83,8 +83,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=2882,
-  serialized_end=2946,
+  serialized_start=2883,
+  serialized_end=2947,
 )
 _sym_db.RegisterEnumDescriptor(_TLSSETTINGS_TLSMODE)
 
@@ -118,7 +118,7 @@
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='exportTo', full_name='istio.networking.v1alpha3.DestinationRule.exportTo', index=3,
+      name='export_to', full_name='istio.networking.v1alpha3.DestinationRule.export_to', index=3,
       number=4, type=9, cpp_type=9, label=3,
       has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
@@ -137,7 +137,7 @@
   oneofs=[
   ],
   serialized_start=171,
-  serialized_end=338,
+  serialized_end=339,
 )
 
 
@@ -195,8 +195,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=721,
-  serialized_end=1068,
+  serialized_start=722,
+  serialized_end=1069,
 )
 
 _TRAFFICPOLICY = _descriptor.Descriptor(
@@ -253,8 +253,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=341,
-  serialized_end=1068,
+  serialized_start=342,
+  serialized_end=1069,
 )
 
 
@@ -291,8 +291,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1224,
-  serialized_end=1269,
+  serialized_start=1225,
+  serialized_end=1270,
 )
 
 _SUBSET = _descriptor.Descriptor(
@@ -335,8 +335,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1071,
-  serialized_end=1269,
+  serialized_start=1072,
+  serialized_end=1270,
 )
 
 
@@ -380,8 +380,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1666,
-  serialized_end=1752,
+  serialized_start=1667,
+  serialized_end=1753,
 )
 
 _LOADBALANCERSETTINGS_CONSISTENTHASHLB = _descriptor.Descriptor(
@@ -434,8 +434,8 @@
       name='hash_key', full_name='istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLB.hash_key',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=1466,
-  serialized_end=1764,
+  serialized_start=1467,
+  serialized_end=1765,
 )
 
 _LOADBALANCERSETTINGS = _descriptor.Descriptor(
@@ -475,8 +475,8 @@
       name='lb_policy', full_name='istio.networking.v1alpha3.LoadBalancerSettings.lb_policy',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=1272,
-  serialized_end=1851,
+  serialized_start=1273,
+  serialized_end=1852,
 )
 
 
@@ -520,8 +520,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2226,
-  serialized_end=2342,
+  serialized_start=2227,
+  serialized_end=2343,
 )
 
 _CONNECTIONPOOLSETTINGS_TCPSETTINGS = _descriptor.Descriptor(
@@ -564,8 +564,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2035,
-  serialized_end=2342,
+  serialized_start=2036,
+  serialized_end=2343,
 )
 
 _CONNECTIONPOOLSETTINGS_HTTPSETTINGS = _descriptor.Descriptor(
@@ -615,8 +615,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2345,
-  serialized_end=2481,
+  serialized_start=2346,
+  serialized_end=2482,
 )
 
 _CONNECTIONPOOLSETTINGS = _descriptor.Descriptor(
@@ -652,8 +652,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1854,
-  serialized_end=2481,
+  serialized_start=1855,
+  serialized_end=2482,
 )
 
 
@@ -711,8 +711,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2484,
-  serialized_end=2688,
+  serialized_start=2485,
+  serialized_end=2689,
 )
 
 
@@ -778,8 +778,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2691,
-  serialized_end=2946,
+  serialized_start=2692,
+  serialized_end=2947,
 )
 
 _DESTINATIONRULE.fields_by_name['traffic_policy'].message_type = _TRAFFICPOLICY